3 ms·
You are misunderstanding the issue. If you only have two bits of entropy, than outputting two bits leaks the entire state, because two bits is brute forceable.
by benchaney 7y ago
You are misunderstanding the issue. If you only have two bits of entropy, than outputting two bits leaks the entire state, because two bits is brute forceable. This is true regardless of the quality of your RNG. The same is true of 32 bits, because 32 bits is also brute forceable. The reason to insert entropy in large chunks is so that an attacker cannot brute force the RNG state, between reseeds.