PRAHARI प्रहरी

Overview

PRAHARI manages a SHA3-256 sponge that continuously absorbs entropy from multiple hardware sources. When keys are needed, getHybridSeed() squeezes 64 bytes from the sponge and XORs them with crypto.randomBytes(64) — a two-source extractor that guarantees cryptographic strength even if one source is compromised.

The system includes an Entropy Sentinel for quality scoring (NPU-accelerated via TIVRA) and TRIBHUJ ternary quality verdicts for mesh-consensus entropy assessment.

Two-Source Extractor

The security model is a two-source extractor. Two independent entropy pools are XORed, so an attacker must compromise both simultaneously:

import { getHybridSeed } from 'yakmesh/security/prahari';

// Returns 64-byte Uint8Array for ML-KEM-768 keygen
const seed = getHybridSeed();

// Both sources must fail simultaneously for compromise.
// Sponge compromised → CSPRNG still protects.
// CSPRNG compromised → sponge (5 hardware sources) still protects.

Five Entropy Sources

The sponge absorbs from five independent hardware entropy sources. Sources register dynamically as subsystems come online via the pluggable EntropySourceRegistry.

import { registerEntropySource } from 'yakmesh/security/prahari';

// Register a custom entropy source (e.g., external TRNG)
registerEntropySource({
  kind: 'external-trng',
  name: 'USB Hardware RNG',
  weight: 7,
  available: () => trngDevice.isConnected(),
  harvest: () => trngDevice.read(32),
});

PrahariSpongeEngine

The core PrahariSpongeEngine is a SHA3-256 sponge accumulator. It absorbs entropy from all registered sources and squeezes domain-separated output on demand.

import { initialize, getHybridSeed, getStatus } from 'yakmesh/security/prahari';

// Initialize the sponge engine
await initialize({
  persistPath: './data/prahari-state.bin',  // optional persistence
  inferenceEngine: accelInference,           // optional: NPU for Sentinel
});

// Primary integration point (called by ANNEX before ML-KEM-768 keygen)
const seed = getHybridSeed();   // Uint8Array(64)

// Full status report
const status = getStatus();
// {
//   initialized: true,
//   sponge: { absorbCount: 847, state: '(hidden)', sizeBytes: 64 },
//   sources: { rdrand: { available: true, contributions: 312 }, ... },
//   sentinel: { available: true, method: 'npu' },
//   telemetry: { hybridSeeds: 42, sentinelPasses: 40, ... }
// }

Entropy Sentinel

The EntropySentinel scores the quality of entropy material. When an ONNX model is loaded and an NPU/GPU is available (via TIVRA), it uses hardware-accelerated pattern detection. Otherwise, it runs four software statistical tests:

The combined score maps to a TRIBHUJ ternary verdict:

import { scoreEntropy } from 'yakmesh/security/prahari';

const result = await scoreEntropy(seedBytes);
// {
//   score: 0.94,
//   verdict: Trit(POSITIVE),
//   method: 'npu',          // or 'gpu' or 'cpu'
//   details: { bitEntropyPerByte: 7.82, chiSquare: 241.3, ... }
// }

SST & Ternary Mathematics

While v3 no longer uses SST families for slot selection, the SST mathematics behind Yakmesh’s ternary stack remain fundamental. PRAHARI’s ternary quality verdicts flow directly from TRIBHUJ balanced ternary primitives:

API Reference

Public Entropy Beacon API

Every YAKMESH node exposes its mesh-consensus entropy as a paranoid entropy beacon. Pulses are signed with the node's ML-DSA-65 identity key, chained via previous_signature, and timestamped by AGUWA. Open CORS and 300 req/min rate limits make this suitable for external entropy consumers.

Client Verification Checklist

Edge Cases & Behavior

Quick Verification Script

# Node.js (ships with yakmesh-node)
npm run verify:beacon https://time.yakmesh.dev

# Or use the Python version
python3 scripts/verify_beacon.py https://time.yakmesh.dev

Version History