> XORing SHA1PRNG against /dev/urandom seems cryptographically nonsensical. Untrue! Assuming that the two (/dev/urandom and SHA1PRNG) are not correlated, the r

> XORing SHA1PRNG against /dev/urandom seems cryptographically nonsensical. Untrue! Assuming that the two (/dev/urandom and SHA1PRNG) are not correlated, the resulting output will be at least as secure as the most secure of the two. This means that (for example) if SHA1PRNG is found to be breakable, SecureRandom will still be at least as secure as /dev/urandom, and vice versa.