There is little more disappointing to see a position you embrace argued with weak or misleading arguments. The entropy estimation used in Linux is indeed essen

There is little more disappointing to see a position you embrace argued with weak or misleading arguments. The entropy estimation used in Linux is indeed essentially pointless, but a number of the arguments used in this page are not great. The main reasons I'd give is that the applications we use randomness for have only computational security at best so the effort to provide information theoretic security is overkill. The actual mechanisms that have been used in linux both for estimating random inputs and maintaining the pool are entirely adhoc and there is no particular reason to believe they'd actually provide information theoretic randomness even if you did have some fringe usage where it could be a theoretical benefit. And finally, the weird behavior like blocking RNGs added for purely conjectural benefits results in real vulnerabilities. Not much more is needed to be said: It's a common story, security theater resulting in insecurity. > so the entropy pool estimator is based on a fair amount of trust in physicists such as Feynman or Bohr (but not Einstein, for that matter). But the entropy depletion is an assertion that cryptographers such as Shamir cannot be equally trusted Our expectations about the security of cryptographic constructs are largely unlike our expectations of physical systems. Thomas is making a cheap and misleading argument here, and I very much expect that Shamir would disagree with it... (heck, one of the famous 'Shamir' named things is shamir secret sharing which comes straight from the realm of information theoretic security.) A case can be made for cryptography with information theoretic security... but what the kernel provided in the past was at best a cargo-cult imitation of it, taking many of its costs without providing its assurances. > The Linux kernel uses rdrand. It does not trust rdrand, because NSA (I’m not exaggerating! The kernel source code explicitly calls out the NSA), Imagine this in a world where the kernel always blindly trusted rdrand: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd... CPU makers can't manage to achieve really strong reliability against obvious _accidental_ fault in rdrand. Gonsidering this, some caution against backdoors in a totally black box magic source of random numbers seems eminently prudent. NSA is just an existence proof of intelligence operations with the intellectual and financial capabilities that would make backdooring a CPU possible, if not likely.