For instance the RNG state is wiped at boot, and relies on the distribution to use scripts to preserve some entropy then restore it across reboots. Some distrib

For instance the RNG state is wiped at boot, and relies on the distribution to use scripts to preserve some entropy then restore it across reboots. Some distributions didn't do this, in particular, OpenWRT didn't do it. On boot its RNG pool was simply the time of day. So the RNG was always being reinitialised to some low-entropy state. Another problem is that the kernel RNG was (at that time, not sure what the current state is like): - Very poorly documented, such that the authors had to reverse engineer it because the docs were scarce or wrong - Very bad at extracting entropy from an idle system. On a server mouse and keyboard events don't really happen, network interrupt timings were "not commonly used as an entropy source" the primary source of entropy was hard disk events. These turned out to provide almost no entropy. Something on the order of 16 bits every ten minutes. - Because the RNG really wanted to use hard disk interrupts and nothing else, OpenWRT had a further issue beyond the pool being reset on boot: it had a read only flash FS that didn't contribute entropy, so was using only network interrupts to seed its RNG pool. But network interrupts on a wireless router can be observed by an adversary. - In pathological cases like an SSD-only serving device without entropy provided at the factory, the entire state of the RNG pool might have come from the user typing in their password. As the algorithm used lacked forward security that would mean an attacker could theoretically extract the password by just requesting random numbers. However they didn't actually demonstrate this attack. So I'd say the vulnerabilities were fairly important albeit they didn't really turn them into a real world attack. I don't know how the kernel RNG addressed them. The RNG has always had some weird ideas - e.g. the way re-injecting stored entropy at startup didn't raise the entropy estimate so lots of programs would hang when trying to generate random numbers from /dev/random and stuff like that.