## 3 Materials and Methods
Nevertheless, this paper explores how to extract randomness from ECG signals by multi-level wavelet decomposition, and to the best of our knowledge, this is the first time this approach has been studied. Therefore, the choice of the most appropriate wavelet family has not been evaluated before in the context of random number generation. Figure 7 summarizes the distribution of \(p\)-values for the tests included in the DIEHARD and NIST suites in order to gain a better overall perspective of the results. The biorthogonal approach can certainly be ruled out as the \(p\)-values were far away from an uniform distribution. In addition, Haar, coiflets and symlets are also not recommended as the median of the \(p\)-values fell well bellow the optimal value of 0.5. For all this, the use of Daubechies or discrete Meyer is recommended since with both approaches, the output stream behaved as a random variable. Figure 7: \(p\)-values (DIEHARD and NIST suite tests). ## 5 Discussion

Regarding the extraction of randomness from cardiac signals, the reader may be tempted to think that this topic has already been studied in the literature. Nevertheless, there is a key-difference between IPI-based approaches, such as [31; 34], and our proposal. In the former, the time difference between two R-peaks is the only information used; note that R-peaks can be read from an ECG record, but also from a Photoplethysmography (PPG) signal. In our approach, a whole ECG trace (P-wave, QRS-complex, T-wave) is needed. As mentioned, the entire ECG signal is used to extract randomness from an ECG-window. In particular, a multi-level decomposition by wavelet analysis is the chosen technique. To the best of our knowledge, this is the first time that this approach has been proposed. It is worth noting that other transform domains (e.g., Fourier or Hadamard) have been tested, but the results were not as good as in the wavelet domain. Regarding the mother wavelet, as shown in Section 4.4, the two recommended families are Daubechies or Meyer. The experimentation has been conducted with the E-HOL-03-0202-003 dataset, which contains 202 subjects recorded over a 24-h period. In the above-mentioned dataset, the subjects were healthy. The proposal could have been tested with a dataset in which the subjects suffer from a cardiac ailment. Nevertheless, this would be a more advantageous scenario since the disease itself would introduce more entropy into the ECG signal. Therefore, in a healthy setting, the worst case scenario for random number generation is considered. Another critical aspect of the proposal is whether an adversary could predict the values of a target user using another user's ECG. The experiments conducted in Section 4.2 clearly point out how the attacker has no chance of success; that is, the adversary's advantage is zero. Furthermore, and unlike IPI-based approaches, in the proposed TRNG, the usage of the entire ECG signal prevents attacks where the heart signal is eavesdropped from a distance. Finally, apart from randomness, throughput is a key aspect for cryptographic primitives. The proposed TRNG far exceeds its predecessors: throughput rate (bytes/s) is multiplied by about 20 in the worst-case scenario. Despite this increment, the study of whether the ECG signal can be further squeezed to extract randomness is a pending work. ## 6 Conclusions

In the last few years, the e-health sector has undergone a major transformation. The population is more concerned about it habits and health and has access to detailed information thanks to the wide variety of low-cost sensors or medical devices that monitor our vital signals and daily activities; all these sensors together with a central gateway make up the WSN and, more particularly, the WBAN when the sensors surround our bodies. In addition, the new generation of medical devices (e.g., pacemakers or insulin pumps) monitor physiological signals and upload these data to the hospital cloud. The doctor can not only check the status of a patient in real time, but can also re-program the device while the