The post here recommends using Intel's RDSEED, which is ironically trusted far less than /dev/urandom by most people who have a secret to keep or a process to protect.
What? If security is a special consideration for some form of data, why would someone choose a non-physical noise source over a hardware-based noise source?
Trust. It's suspected that RDSEED is essentially backdoored based on the published structure of the RNG. TRNGs are allowed to use a cryptographic conditioning component on top of a non-full-entropy physical stream, and that is what Intel does, using a long-lived secret key. The output you see is actually the result of cryptographic postprocessing, which may be partially transparent to the entity that has the secret key.
Intel has no published third-party audits of their silicon, and has a very close relationship with some three-letter agencies. Hence the concern.
By contrast, urandom is completely open, and is reseeded relatively frequently with entropy. If both are effectively acting as a CSPRNG, the one with public attention and no secret key that can be handed to a third party is better.
Comments
What? If security is a special consideration for some form of data, why would someone choose a non-physical noise source over a hardware-based noise source?
Trust. It's suspected that RDSEED is essentially backdoored based on the published structure of the RNG. TRNGs are allowed to use a cryptographic conditioning component on top of a non-full-entropy physical stream, and that is what Intel does, using a long-lived secret key. The output you see is actually the result of cryptographic postprocessing, which may be partially transparent to the entity that has the secret key.
Intel has no published third-party audits of their silicon, and has a very close relationship with some three-letter agencies. Hence the concern.
By contrast, urandom is completely open, and is reseeded relatively frequently with entropy. If both are effectively acting as a CSPRNG, the one with public attention and no secret key that can be handed to a third party is better.