&gt; If you want to look at a userspace CSPRNG done right (or what I believe to be one done right) just take a look at BoringSSL&#x27;s[1].<p>BoringSSL just uses &#x2F;dev&#x2F;urandom directly. It&#x27;s not a userspace CSPRNG. And as you pointed out, for GNU&#x2F;Linux systems, it&#x27;s slow. This is why userspace designs, such as CTR_DRBG, HMAC_DRBG, and Hash_DRBG exist- so you can have a fast userspace CSPRNG with backtracking resistance.<p>Case in point. On my laptop:<p>$ pv &lt; &#x2F;dev&#x2F;urandom &gt; &#x2F;dev&#x2F;null<p>1.02GB 0:01:20 [13.3MB&#x2F;s] [                   &lt; =&gt;                              ]<p>$ openssl enc -aes-128-ctr -pass pass:&quot;sHgEOKTB8bo&#x2F;52eDszkHow==&quot; -nosalt &lt; &#x2F;dev&#x2F;zero | pv &gt; &#x2F;dev&#x2F;null<p>2.13GiB 0:00:11 [ 198MiB&#x2F;s] [               &lt;=&gt;                                 ]<p>And on a server with AES-NI:<p>$ pv &lt; &#x2F;dev&#x2F;urandom &gt; &#x2F;dev&#x2F;null<p>2.19GiB 0:01:06 [  20MiB&#x2F;s] [                     &lt;=&gt;                           ]<p>$ openssl enc -aes-128-ctr -pass pass:&quot;sHgEOKTB8bo&#x2F;52eDszkHow==&quot; -nosalt &lt; &#x2F;dev&#x2F;zero | pv &gt; &#x2F;dev&#x2F;null<p>31.9GB 0:00:34 [ 953MB&#x2F;s] [                                  &lt; =&gt;               ]<p>I&#x27;ve seen other hardware with AES-NI that can go north of 2 GiBps, as I already mentioned. Although not backtracking resistant, those are fast userspace CSPRNGs, that are clean in design.<p>I&#x27;ve designed userspace CSPRNGs that adhere to the NIST SP 800-90A standards. They&#x27;re seeded from &#x2F;dev&#x2F;urandom on every call, and perform much better than relying on &#x2F;dev&#x2F;urandom directly. I won&#x27;t say they&#x27;re bug free, but if you read and follow the standard (<a href="http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;nistpubs&#x2F;800-90A&#x2F;SP800-90A.pdf" rel="nofollow">http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;nistpubs&#x2F;800-90A&#x2F;SP800-90A...</a>), it&#x27;s not too terribly difficult to get correct, and PHP, Perl, Python, Ruby, and other interpreted languages can outperform the kernelspace CSPRNG.