@@ -2,7 +2,7 @@
 resolver = "2"
 members = [
     "crates/kdk-zeroize",
-    # "crates/kdk-entropy",
+    "crates/kdk-entropy",
     # "crates/kdk-kef",
     # "crates/kdk-menu",
     # "crates/kdk-psbt",
 
@@ -0,0 +1,11 @@
+[package]
+name = "kdk-entropy"
+version = "0.0.1"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Origin-tagged entropy primitives for KDK"
+
+[dependencies]
+kdk-zeroize = { path = "../kdk-zeroize" }
+sha2 = { version = "0.10", default-features = false }
@@ -0,0 +1,67 @@
+use sha2::{Digest, Sha256};
+
+use crate::error::EntropyError;
+use crate::utils::check_length;
+use crate::CoinEntropy;
+
+/// Minimum flips required to fill an `N`-byte entropy buffer with a
+/// fair coin.
+pub const fn min_flips<const N: usize>() -> Result<usize, EntropyError> {
+    match N {
+        16 => Ok(128),
+        32 => Ok(256),
+        _ => Err(EntropyError::UnsupportedConfig(2, N)),
+    }
+}
+
+/// Practical upper bound on flip count — 2× [`min_flips`].
+pub const fn max_flips<const N: usize>() -> Result<usize, EntropyError> {
+    match min_flips::<N>() {
+        Ok(m) => Ok(m * 2),
+        Err(e) => Err(e),
+    }
+}
+
+/// Fold a sequence of coin flips into an `N`-byte entropy buffer.
+///
+/// Flips are formatted as a concatenated string of `"0"` / `"1"` ASCII
+/// digits, SHA-256 hashed, then the first `N` bytes of the digest are
+/// taken. Mirrors Krux's dice-string approach for `FACES < 10`.
+///
+/// # Example
+///
+/// ```
+/// use kdk_entropy::{coin_to_entropy, CoinEntropy};
+///
+/// // SHA-256("0" * 128)[:16].
+/// let flips = [0u8; 128];
+/// let e: CoinEntropy<16> = coin_to_entropy(&flips).unwrap();
+/// assert_eq!(
+///     e.expose_secret(),
+///     &[
+///         0x45, 0x72, 0x57, 0x91, 0xc4, 0x7b, 0x32, 0x61,
+///         0x8c, 0xc5, 0x7b, 0x88, 0x34, 0x3e, 0x2b, 0xce,
+///     ]
+/// );
+/// ```
+pub fn coin_to_entropy<const N: usize>(flips: &[u8]) -> Result<CoinEntropy<N>, EntropyError> {
+    let required = min_flips::<N>()?;
+    let allowed = max_flips::<N>()?;
+    check_length(flips.len(), required, allowed)?;
+
+    for (i, &flip) in flips.iter().enumerate() {
+        if flip > 1 {
+            return Err(EntropyError::RollOutOfRange(flip, i));
+        }
+    }
+
+    let mut hasher = Sha256::new();
+    for &flip in flips {
+        hasher.update([b'0' + flip]);
+    }
+    let digest = hasher.finalize();
+
+    let mut acc: CoinEntropy<N> = CoinEntropy::new([0u8; N]);
+    acc.expose_secret_mut().copy_from_slice(&digest[..N]);
+    Ok(acc)
+}
@@ -0,0 +1,103 @@
+use sha2::{Digest, Sha256};
+
+use crate::error::EntropyError;
+use crate::utils::check_length;
+use crate::DeckEntropy;
+
+/// Minimum card draws required to fill an `N`-byte entropy buffer
+/// from a `CARDS`-deck. Each entry is the smallest `k` such that
+/// `log₂(CARDS! / (CARDS-k)!) ≥ 8·N`.
+pub const fn min_draws<const CARDS: u8, const N: usize>() -> Result<usize, EntropyError> {
+    match (CARDS, N) {
+        (40, 16) => Ok(28),
+        (48, 16) => Ok(26),
+        (52, 16) => Ok(25),
+        (58, 16) => Ok(24),
+        (58, 32) => Ok(55),
+        (78, 16) => Ok(22),
+        (78, 32) => Ok(45),
+        (108, 16) => Ok(22),
+        (108, 32) => Ok(41),
+        (112, 16) => Ok(22),
+        (112, 32) => Ok(42),
+        _ => Err(EntropyError::UnsupportedConfig(CARDS, N)),
+    }
+}
+
+/// Practical upper bound on draw count — `2 * min_draws`, capped at `CARDS`.
+pub const fn max_draws<const CARDS: u8, const N: usize>() -> Result<usize, EntropyError> {
+    match min_draws::<CARDS, N>() {
+        Ok(m) => {
+            let doubled = m * 2;
+            let cap = CARDS as usize;
+            Ok(if doubled > cap { cap } else { doubled })
+        }
+        Err(e) => Err(e),
+    }
+}
+
+/// Fold a sequence of drawn cards into an `N`-byte entropy buffer.
+///
+/// Cards are formatted as decimal indices, hyphen-separated, SHA-256
+/// hashed, then truncated to `N` bytes. Mirrors Krux's d20 string
+/// shape (`"-".join`) for multi-digit values.
+///
+/// # Example
+///
+/// ```
+/// use kdk_entropy::{deck_to_entropy, DeckEntropy};
+///
+/// // SHA-256("0-1-2-3-...-24")[:16].
+/// let cards: [u8; 25] = [
+///     0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
+///     10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
+///     20, 21, 22, 23, 24,
+/// ];
+/// let e: DeckEntropy<52, 16> = deck_to_entropy(&cards).unwrap();
+/// assert_eq!(
+///     e.expose_secret(),
+///     &[
+///         0x92, 0xe2, 0x92, 0xe3, 0x4c, 0x44, 0x48, 0xc1,
+///         0x57, 0x73, 0x1a, 0xff, 0x3d, 0x40, 0x10, 0x38,
+///     ]
+/// );
+/// ```
+pub fn deck_to_entropy<const CARDS: u8, const N: usize>(
+    cards: &[u8],
+) -> Result<DeckEntropy<CARDS, N>, EntropyError> {
+    let required = min_draws::<CARDS, N>()?;
+    let allowed = max_draws::<CARDS, N>()?;
+    check_length(cards.len(), required, allowed)?;
+
+    // Validation pass: range + uniqueness. `present[i]` is non-secret
+    // bookkeeping for which indices remain undrawn.
+    let mut present = [true; 256];
+    for (i, &card) in cards.iter().enumerate() {
+        if card >= CARDS {
+            return Err(EntropyError::RollOutOfRange(card, i));
+        }
+        if !present[card as usize] {
+            return Err(EntropyError::DuplicateCard(card, i));
+        }
+        present[card as usize] = false;
+    }
+
+    let mut hasher = Sha256::new();
+    for (i, &card) in cards.iter().enumerate() {
+        if i > 0 {
+            hasher.update(b"-");
+        }
+        if card >= 100 {
+            hasher.update([b'0' + card / 100]);
+        }
+        if card >= 10 {
+            hasher.update([b'0' + (card / 10) % 10]);
+        }
+        hasher.update([b'0' + card % 10]);
+    }
+    let digest = hasher.finalize();
+
+    let mut acc: DeckEntropy<CARDS, N> = DeckEntropy::new([0u8; N]);
+    acc.expose_secret_mut().copy_from_slice(&digest[..N]);
+    Ok(acc)
+}