Regardless of your RNG algorithm, outputting 2 bits always[1] leaks a 2 bit state. If your state is only 2 bits[0], then there are only 4 possible states. With

Regardless of your RNG algorithm, outputting 2 bits always[1] leaks a 2 bit state. If your state is only 2 bits[0], then there are only 4 possible states. With significant probability, your two output bits will be inconsistent with 3 of them. In general, a N bit output will be inconsistent with 2^N - 1 of your 2^N possible internal states; the point of using ~256 bits of entropy is to ensure that it's computationally intractable to figure out which, and that only works if the attacker can't work out the first (second, etc) 32 bits separately from the subsequent ones. 0: of entropy, mind, not data. If the attacker knows your 64-byte RNG buffer, and you inject 2 bits of entropy, there are only 2^2=4 new 64-byte blobs that your buffer could have evolved to, so you have 512 bits of data with only 2 bits of entropy. 1: for any algorithm that is; on a per-event basis, there's obviously a chance that you happen to produce output that's consistent with multiple possible internal states.