Is it secure to concatenate two 16-bit random numbers into a 32-bit one? I'm working on a security application for RF modules aimed to protect a communication between an autarkic sensor and a line-powered receiver against MITM (man-in-the-middle attacks). I decided to use a communication approach based on a unilateral authentication using a 32-bit random as Nonce with time limited validation. I'm using for that a specific development tool, a specific library written in C and a compiler(C51 of Keil microvision for those who heard about it).

This specific library is offering me the possibility to generate a 16-bit random number reading the noise of an ADC. I suppose it is a true random. So I thought of calling this function twice and concatenating the outputs to produce a 32-bit random but I'm not quite sure if it is a secure way to process a random number. So I'm asking you guys:


What is the entropy in the resulting value? (I read an Intel post
saying that it is 17 bits of entropy in my case but I'm wondering if
it's correct and I heard others saying that it is always 32 bits of
entropy.)
How to evaluate the distribution of the resulting values over the
whole range of 32 bit values [0...2^32]?
By calling my function twice to generate the 16-bit random values,
the noise of the ADC will be read twice but considering that the
process of generating these numbers is based on microscopic phenomenon  I  suppose it is unlikely to have two equal values such as 0x12341234 or 0xAABBAABB or whatever. It means maybe that these numbers are less likely to come than the others. Correct?
And last but not least, does using a cryptographic mixing (quadratic
residues maybe?) after concatenating the two improve the
level of security (entropy) of the resulting value or not?
The Intel post which I think you mean was discussed in this question and as I wrote there, the limitation only applies in the case of trying to combine PRNG outputs into values larger than the seed entropy (two 256-bit values in their case). Also mentioned there: cryptographic mixing does not increase the entropy you have, so if concatenation is insecure, just mixing is as well.

So, whether you can concatenate two 16-bit values depends on how the library/hardware works:


If you are getting raw noise readings it is unlikely it has 16 bits of entropy per value. You would need to collect many and mix them into a single value if you wanted truly random values. And you would need to find out what sort of correlations the data has to determine the entropy rate.
More likely, there is already some mixing/whitening going on that tries to assure full entropy for the output values. If that is the case, you can combine them just fine.
If the library uses a PRNG to generate more output values than the input entropy from the hardware you again cannot combine two values and retain full entropy.