2 ms·

NSA does probably want it, and did probably standardized at least one such scheme in the past: Dual_EC_DRBG.