&quot;the &quot;uncertain mathematical constructions&quot; are hashes. More precisely, in Linux case, SHA-1 preimage (not collision) security. No civilian cryptosystem would survive the fall of hashes.&quot;<p>The fall of a RNG by biasing its bits is more likely than a full, second-preimage attack on a hash. So, a failure of hash function in one app != failure in all apps. You&#x27;re certainly right that it would have bigger implications but might still be useful as MD5 is if collisions are out of scope.<p>&quot;all other points are void as soon as you use that randomness from a regular application running on regular CPUs, as all the bit-flips, compromises and backdoors can simply happen there.&quot;<p>There&#x27;s a lot of CPU&#x27;s to choose from to reduce that risk. There&#x27;s systems like Gaisler&#x27;s Leon3-FT that are open-source, have resistance to bitflips, support mods like TRNG&#x27;s, and run Linux. At this point, they have to subvert your ASIC process, mask manufacturing, or supply chain. Harder than a purchasing a Linux 0-day if target has decent OPSEC and avoids spy-friendly jurisdictions. ;)<p>If it&#x27;s on Intel&#x2F;AMD&#x2F;IBM, your comment is true in most cases.<p>&quot;but there we are speaking of HSM capable of doing the private key operations themselves, not simply providing randomness.&quot;<p>I was speaking of both. One problem I have is bootstrapping randomness. I do it by hand with cards whose entropy feeds into a CRNG unless I have a trustworthy TRNG. A plug-in, analog source with dumb, interface chip isn&#x27;t going to be compromise by hackers... probably. Likewise, I can go further with a simple, coprocessor w&#x2F; ROM, memory protection, dumb interface, and onboard TRNG. Many available from many vendors of varying trustworthiness. Still safer than base system w&#x2F; kernel RNG and can even monitor (or restore) host system if I choose.<p>&quot;let me spell out why this all does not apply to the 99% of us developing for consumer processor architectures&quot;<p>I still agree with that, though. Main reason is nobody in 99% is going to use anything high-security because it will cost more, be inconvenient, and lack feature&#x2F;app X, Y, or Z. Always was the case. :)