edit: also, when i play solitaire via an ipad app there is always a 'top score' by someone for the hand i was dealt. i dont understand how this is probabilistically possible
https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle#P...
That is, is there enough entropy in your typical PRNG to actually generate all of those shuffles with equal probability.
But in reality you don't care. You could seed the PRNG with the current system time in nanoseconds or something, and every game you'll ever play is different. Even if the PRNG has limited state, you'll never notice it as a human player.
So it might be possible that your secure PRNG still cannot generate all permutations.
The key difference is that your PRNG could be cryptographically secure even though X < Y. It turns out that Y ≈ 226 bits, and so it's plausible that your cryptographically secure RNG would have X = 128 bits, for example, even though I'd typically expect a larger number.
People often conflate entropy with security. A random number source could have high amounts of entropy and be insecure, while a random number source with less entropy could be very secure. Or let me put it this way: entropy is necessary but not sufficient for security.
It is not the case that using /dev/random somehow gets you an information-theoretic security level that /dev/urandom doesn't.
I was thinking, "Oh, the mixing is good enough for practical use." But that's not what information-theoretic means.
I was thinking, "Oh, assuming the entropy estimation works." But we know it doesn't.
It was a stupid argument. But then again, /dev/random is stupid. Nobody gives a damn about information-theoretic security, and we don't have it anyway.
Something like a properly seeded 256 bit xorshift might satisfy this as a random number generator. But even that setup may not be sufficent.