A simple thought exercise to show you how false this is:<p>Instantiate AES-128-CTR with a random key. Encrypt 100 megabytes with it. Have you &quot;drained&quot; &quot;key&quot; from AES? No, not in any meaningful sense. If you could, the AES-CTR recommendations would say &quot;don&#x27;t encrypt more than 100 megabytes with AES-CTR&quot;. In practice, people routinely encrypt many gigabytes with it.<p>Every modern OS uses a DRBG for its kernel CSPRNG. You can think of a DRBG as a stream cipher, just like AES-128-CTR, where random events are hashed to form the key, and the output is the raw keystream. Asking for 100 megabytes of additional keystream doesn&#x27;t &quot;drain&quot; the &quot;key&quot; from the keystream.<p>Linux has a terrible misfeature, born of a failure to understand the crypto primitives they&#x27;re using in their CSPRNG. &#x2F;dev&#x2F;random keeps an &quot;estimator&quot; that tries to determine how much &quot;entropy&quot; has been fed to the CSPRNG, and it decrements that estimator when requests come in for random bytes. Linux <i>claims</i> you can drain its CSPRNG. Linux is wrong; that is not how crypto works.<p>Linux should lose that feature, but they will not. But there&#x27;s no reason you should have to go along with it; just use urandom, which will not block for the estimator.