Entropy and the NetBSD Kernel
A couple of considerations:<p>Regarding the hostname thing, the NISP SP800-90Ar1 specs for PRNGs include &quot;personalization strings&quot; as an optional part of the initialization. Lots of other systems have similar parameters. The fundamental idea is that randomness sources are sometimes subject to failure, especially as you ask for more and more random data (e.g., until recently, &#x2F;dev&#x2F;random on Linux would block if it &quot;didn&#x27;t have enough entropy&quot;, and there have been plenty of issues related to code NOT CHECKING for short reads). The NIST spec suggests using things like serial numbers, user IDs, MAC addresses, software versions, timestamps, module and applications, even random numbers derived from other sources as parts of the personalization string. The idea is that each PRNG created will always have at least one unique input to it, so you at least avoid repeated outputs if the seeds and the nonces get hosed up.<p>So there&#x27;s a case to be made for hauling in low-randomness data, even if it doesn&#x27;t help accumulate enough randomness. The hostname certainly isn&#x27;t perfect (think of all those Raspberry Pis with the same hostname), but it doesn&#x27;t HURT as long as we&#x27;re honest about what that input is providing (distinction versus randomness).<p>Also: the author notes that some of the random sources they tested are highly biased. While biased output from a random source isn&#x27;t GREAT, it isn&#x27;t necessarily a showstopper. The key thing for security in this context is not a lack of bias, but a lack of predictability. Suppose I have a biased random source, with a 1&#x2F;3 probability of outputting a 1, and a 2&#x2F;3 probability of outputting a 0. If there&#x27;s nobody out there who can predict the NEXT output with probability greater than 2&#x2F;3 (i.e., it&#x27;s not backdoored or subject to some nasty attack), then it&#x27;s just fine as a random source. We just can&#x27;t treat each bit we read as providing a &quot;full bit&quot; of random into the system. In the example above, you could just seed your 256-bit PRNG with about 280 bits of biased input. Alternatively, you could just do the old &quot;read twice: discard if results match; otherwise take the first value&quot; trick to get an unbiased source.<p>Also, it&#x27;s important to remember that &quot;entropy&quot; in these conversations is used in a squishy way, and it&#x27;s easy to mix up different definitions of the term. Folks talking about &quot;entropy&quot; in the context of PRNGs usually mean unpredictability, unstructuredness, unrecoverability, or some combination thereof. They typically do <i>not</i> mean Shannon entropy, which is essentially a measure of UNIFORMITY of output . If you feed the numbers 0 through 255-- in order-- into an entropy calculator, it will report exactly 8 bits of entropy, even though the input was clearly structured and predictable. That&#x27;s why I&#x27;ve tried to avoid using the term &quot;entropy&quot; and focus on &quot;random&quot; or &quot;randomness&quot;.<p>As for backdoors-- it&#x27;s theoretically possible that things like RDRAND or a USB key or whatever can be compromised. Standard, non-dedicated randomness inputs (like keystroke timing, network packet arrival times, disk I&#x2F;O info, interrupt timing, clock drift, etc.) are still included in OS PRNGs, and PRNG state is periodically updated to fold in that randomness. While it isn&#x27;t EASY for a hardware backdoor to overcome this, it&#x27;s theoretically possible, and it only takes a small amount of influence to create some devastating effects. Dan Bernstein wrote an article back in 2014 about the hardware backdoor idea; one very simple suggestion that he made was to simply design cryptosystems to use LESS random data (his Ed25519 system generates nonces deterministically, for instance).