Except they do use rdrand if supported.  When the random function is called it does a SHA transform.  The SHA state gets initialized with rdrand and then the kernel pool is mixed in.  This avoids the theoretical issues with xoring rdrand directly into the output.<p>You should generally avoid xor when it comes to untrusted output such as rdrand since it could theoretically control what gets generated and as such could cancel out whatever you&#x27;re xoring it with (or at least this is the claim AFAIK).  It&#x27;s better to mix it using some other method, e.g. hash or cipher[1].<p>[1] <a href="https:&#x2F;&#x2F;boringssl.googlesource.com&#x2F;boringssl&#x2F;+&#x2F;master&#x2F;crypto&#x2F;rand&#x2F;rand.c#29" rel="nofollow">https:&#x2F;&#x2F;boringssl.googlesource.com&#x2F;boringssl&#x2F;+&#x2F;master&#x2F;crypto...</a>