High-assurance security products (eg Type 1 NSA stuff) have always relied on verifiable or dedicated RNG&#x27;s. Typically TRNG&#x27;s. Here&#x27;s some reasons:<p>1. Easier to trust one based on physics with decades of verification of its behavior vs mathematical constructions with vastly less certainty or verification of correctness.<p>2. Bit-flips or EMI on internal state might affect a software algorithm&#x27;s randomness. Won&#x27;t happen with certain types of analog noise with carefully tuned and measured circuits.<p>3. Can verify the circuits do exactly what I expect by eye and hand with a logic analyzer. No speculation due to No 1. Can then trust that circuit as a pluggable component in any other system without further evaluation.<p>4. Building on above, a compromise of the host PC requires me to recover the host but not dedicated chips like the TRNG or proper HSM. I can still trust them if they have no firmware (eg analog TRNG) or it&#x27;s not write-able.<p>5. Using Nizza Architecture, I can put Linux in an untrusted partition with crypto&#x2F;CRNG&#x2F;secure-storage directly on microkernel in dedicated, isolated partition. TRNG HW or dedicated crypto SOC gives me this plus benefits above.<p>So, the difference between high-assurance setup with HW support for security-critical functions and software on an untrustworthy box... probably x86 with its vPro backdoor circuitry... is pretty astounding in capabilities. Seeing the differences &amp; how cheap you can do that stuff should make anyone wonder why it&#x27;s not standard in security-focused projects.