AMD EPYC silicon under scrutiny after a community test revealed the RNG never outputs zero.
AMD RNG FAILS TO PRODUCE ZERO, EXPOSES CRYPTO WEAKNESS
*A hardware RNG in AMD's Ryzen and EPYC CPUs skips the value zero, biasing millions of cryptographic operations. The flaw surfaced on a niche forum, but its implications span cloud providers, VPNs, and any software that trusts AMD's built‑in entropy.*
When a hardware random number generator omits a single bit pattern, the error reverberates through every encryption routine that depends on it. AMD’s on‑chip RNG, marketed as a zero‑trust source of entropy, was found to never emit the integer 0. The anomaly was first flagged on a Hacker News thread where a user posted a 10‑million‑sample dump showing a 0‑frequency of 0 %.
The thread attracted seasoned cryptographers who replicated the test on multiple Ryzen 7 5800X and EPYC 7742 silicon. All runs reproduced the missing zero, confirming a systematic bias rather than a fluke. AMD’s RNG feeds the AMD Secure Processor, the backbone of Secure Boot, TLS offload, and virtual machine isolation. If the bias propagates into key generation, the theoretical entropy drops from 128 bits to roughly 127.999 bits—practically negligible but mathematically exploitable.
Industry watchdogs are already flagging the issue. Microsoft’s Azure team, Amazon’s EC2 engineers, and OpenSSL maintainers have been notified. The clock is ticking; any delay widens the attack surface for side‑channel and statistical attacks.
The Bug Unveiled
The discovery originated from a post titled “AMD's random number generator can't generate a 0?” on board.flatassembler.net. User “phillip” uploaded a CSV of 10,000,000 64‑bit outputs harvested via the RDRAND instruction. Statistical analysis showed a uniform distribution for every value except 0, which appeared zero times. Independent testers on Linux, Windows, and macOS reproduced the pattern using the same instruction set. The bias persisted across firmware versions 1.0.0.0 through 1.2.3.4 and across silicon revisions spanning 2017‑2022. AMD’s own documentation claims a “full‑range uniform distribution” for its hardware RNG, a claim now contradicted by empirical data. The thread attracted over 2,300 comments, many from security researchers who ran chi‑square tests confirming a p‑value well below 0.001 for uniformity.
Technical Roots
AMD’s RNG chain consists of a true‑entropy source, a post‑processor, and the RDRAND interface. The post‑processor applies a Von Neumann extractor to eliminate bias, but a coding error in the zero‑filter logic discards any output that evaluates to 0 after whitening. The bug stems from an off‑by‑one index in the final compression step, a mistake that escaped AMD’s internal verification suite. Intel’s counterpart, DRNG, passes the same test suite without incident, highlighting a divergence in quality assurance. AMD’s Secure Processor firmware, responsible for seeding OS‑level entropy pools, inherits the same flaw, meaning any software that calls /dev/random or CryptGenRandom on AMD hardware receives a subtly skewed pool.
Security Fallout
A missing zero reduces the theoretical entropy of a 128‑bit key by a single bit. While a one‑bit loss seems trivial, it creates a deterministic pattern exploitable by a sophisticated adversary with access to large ciphertext samples. TLS handshakes that rely on AMD‑generated nonces could, in theory, repeat after 2^127 attempts instead of 2^128. Cloud providers running AMD EPYC instances for Kubernetes clusters now face a compliance risk under NIST SP 800‑90B, which mandates full‑range entropy. OpenSSL’s FIPS mode, which audits entropy sources, will have to flag AMD hardware until a firmware fix is released. Security firms have already drafted advisory notices for VPN vendors and blockchain nodes that default to AMD CPUs.
Response and Roadmap
AMD issued a terse statement on September 18, acknowledging “a potential anomaly in entropy generation” and pledging a firmware update within “the next two quarters.” The company’s Chief Security Officer, Dr. Lisa Cheng, promised a “full audit of the RNG pipeline.” Meanwhile, the Linux kernel community has merged a patch that adds a sanity check for zero‑frequency in /dev/hwrng, warning users when the bias exceeds 0.01 %. Microsoft’s Azure team has begun rolling out a software‑only mitigation that mixes AMD RNG output with ChaCha20‑based entropy. The industry expects a definitive microcode fix by Q1 2027, but the window leaves millions of servers exposed in the interim.
AMD’s zero‑bias bug is a reminder that even mature silicon can harbor critical oversights. The clock is already ticking for enterprises that have baked AMD’s hardware RNG into their security perimeter. Until a firmware patch lands, operators must layer additional entropy sources or risk exposing cryptographic keys to statistical attacks. The next wave of chip releases will be judged not just on performance, but on whether they can guarantee every bit truly rolls the dice.
Sources: Hacker News thread (board.flatassembler.net), AMD security advisory, Linux kernel patch series, statements from Dr. Lisa Cheng (AMD) and Dr. Elena Martínez (CipherTrace).