@npub1jg552...

Technical question for the Blockstream/Jade team regarding Jade Classic (original ESP32) + No-Radio firmware, especially around v1.0.40.

In v1.0.40, Jade initialized its 256-bit entropy state with:

bootloader_random_enable();
esp_fill_random(entropy_state, 32);
bootloader_random_disable();

On the original ESP32, bootloader_random_enable() enables the SAR ADC entropy source when RF/Wi-Fi/Bluetooth are disabled.

The point I am trying to understand is the entropy extraction rate.

For ESP32 Classic, esp_random() uses:

APB_CYCLE_WAIT_NUM = 16

With an 80 MHz APB clock, this corresponds to a minimum enforced interval of ~0.2 us between RNG reads (~5 MHz theoretical maximum, excluding execution overhead).

However, the ESP32 Technical Reference Manual recommends reading RNG_DATA_REG at no more than ~500 kHz when using the SAR ADC in order to obtain maximum entropy, which corresponds to ~2 us per 32-bit read.

So there appears to be a difference between:

SAR ADC recommendation:
<= 500 kHz

> = ~2 us/read

esp_random() on ESP32 Classic:

> = ~0.2 us/read minimum enforced delay
> ~5 MHz theoretical maximum

Espressif also uses a much more conservative extraction rate in its bootloader RNG code when the SAR ADC is the entropy source.

At the same time, Espressif explicitly documents bootloader_random_enable() + esp_random()/esp_fill_random() as a valid way of obtaining true random numbers when RF is disabled.

Jade later changed this logic and now performs individual esp_random() calls separated by ~1 ms, explicitly mentioning additional time for HWRNG entropy refeeding and scheduler jitter.

My questions are:

1. Did Blockstream measure or estimate the min-entropy of esp_fill_random(32) on ESP32 Classic with bootloader_random_enable() active and RF disabled?

2. Was the ESP32 TRM recommendation of <=500 kHz for maximum SAR entropy considered?

3. Is there a known lower bound for the min-entropy of the 256-bit entropy_state generated by Jade v1.0.40 in this configuration?

4. Was the later 1 ms delay purely defense-in-depth, or was it also intended to remove uncertainty about the SAR entropy refresh rate on the original ESP32?

5. Does Blockstream consider a 12-word BIP39 mnemonic generated on Jade Classic + No-Radio + v1.0.40 to retain the full expected 128 bits of entropy?

I am not claiming a demonstrated vulnerability. I am trying to understand how the entropy guarantees of Espressif's SAR ADC/HWRNG path were evaluated in Jade.