<i>But you don&#x27;t need to do that. You simply take 256 bits and use them as an AES key. You then generate a stream of bits and write that to disk. Reading the disk afterward is equivalent to breaking AES.</i><p>Completely agreed. I&#x27;ve already mentioned in this post about only using the Linux CSPRNG to seed a userspace CSPRNG, because the Linux CSPRNG is horrendously slow, due to its ad-hoc design. However, if the Linux CSPRNG was AES-128 using the standard CTR_DRBG, with AES-NI, it could go north of 2 GiBps without breaking a sweat, keeping clean random.c code (it already ships aes.h), and it&#x27;s backtracking resistant.<p>However, if you&#x27;re going to spend good money for hardware producing random values, at least for me, I&#x27;m going to want the best bang for my buck. If you look at <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Comparison_of_hardware_random_number_generators" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Comparison_of_hardware_random_...</a>, you can spend $35 for the WaywardGeek &quot;Infinite Noise RNG&quot;, which outputs 300 Kbps, or spend $24 for an RTL-SDR dongle and get about 2.8 MiBps. The value of bits per dollar is much higher with the RTL-SDR than the WaywardGeek. This is considerably cheaper than getting a radioactive sample, coupled with a Geiger counter.<p><i>IDQuantique sells a product that purportedly generates millions of random bits per second. If I were gambling at a casino, I&#x27;d feel more comfortable with that than with randomness from an AES stream. Yeah, I know I&#x27;m thinking irrationally.</i><p>Yeah, that is irrational. The problem with most TRNGs is that their output is biased. As a casino operator, I might be interested if the bias benefits my casino, but I would also need to prove to regulators that I&#x27;m not cheating the public. Personally, I&#x27;d err on the side of caution when it comes to the law.<p>So either I would whiten the output with a cryptographic primitive (John von Neumann debiasing is too costly, losing at least 1&#x2F;2 the bits), or just write a userspace CSPRNG, and get the throughput you&#x27;ll need for the demand. I could then constantly rekey&#x2F;rseed the generator with the TRNG if I was tinfoil-hat-paranoid.<p>In either case, TRNG or CSPRNG, you&#x27;ll want exceptional throughput for your casino. Which brings us back to another example of which 800 bps just isn&#x27;t going to cut it. :)