Linus Torvalds: Remove RdRand from /dev/random
change.org
change.org
“Where do I start a petition to raise the IQ and kernel knowledge of people? Guys, go read drivers/char/random.c. Then, learn about cryptography. Finally, come back here and admit to the world that you were wrong. Short answer: we actually know what we are doing. You don't. Long answer: we use rdrand as _one_ of many inputs into the random pool, and we use it as a way to _improve_ that random pool. So even if rdrand were to be back-doored by the NSA, our use of rdrand actually improves the quality of the random numbers you get from /dev/random. Really short answer: you're ignorant.”
For example if my RNG just outputs a series of 5s, surely that would weaken the pool even if the other nine sources were lovely lovely entropy? What is the 'threshold' for tolerable degradation?
The patch that was finally accepted for the Linux kernel was to mix-in RdRand but not to increment the entropy counter. To me as a layman that suggests that if the other inputs are weak at any time ( e.g. soon after boot ) then RdRand will be dominant.
What does it mean to be '#rekt'? Is it the phonetic spelling of "wrecked"?
If you want to affect change, write a letter to your local representative.
Do not spend 60 seconds putting your email address into a random website on the Internet that no politician is ever going to take note of that site since it doesn't represent their constituents. People think they are making things better by putting their name against something or liking something, but it means nothing.