Any good crypto library will have a solid secure random source that usually combines entropy from multiple sources with a provably secure hash based mixing scheme.

Hardware RNGs can be one source, but no single source is trusted, and they're all combined in a way where even an intentionally malicious source is lost in noise and cannot actually determine output.

▲

Taek 15 minutes ago | parent | next [-]

That's exactly the challenge though: "any good crypto library" - there is a long history of meaningful security breached (like stolen crypto tokens) due to bugs in an upstream library, especially when using things like embedded code, alternative operating systems, newer programming languages, etc.

The value of the iterated hashing method is that it is dead simple and has little dependency on potentially buggy upstream code; it works even in very lightweight environments designed by engineers with no experience in security.

▲

strenholme 41 minutes ago | parent | prev [-]

There are theoretical issues where a malicious source of entropy could control the PRNG output, but it’s not a very practical attack.

https://blog.cr.yp.to/20140205-entropy.html

Intel could much more easily compromise and attack systems than make an implementation of RdRand which is malicious in this manner.

▲

api 37 minutes ago | parent [-]

Oh yeah, if your hardware is malicious you are pretty much F'd.

	▲	strenholme 17 minutes ago \| parent [-]
		Yeah, this comes off as a “they already are on the wrong side of the secure hatch” kind of attack. A malicious hardware device with physical access to a victim’s computer can do a lot more than generate malicious entropy. It’s like the attacks I occasionally see which are like “once we have administrator, we can attack the process because of this insecurity”. Well, yeah, but once we have administrator, we can read the entire memory of the “vulnerable” process and completely control its output too. I’ve seen in the real world attacks where things were insecure because the PRNG wasn’t given enough entropy (CVE 2008-0166, Coldcard, etc.). I’ve never seen real world attacks where a PRNG was insecure from getting too much entropy.