Hector Martin

You can get entropy out of *asynchronous clocks*. Anything else is just a shitty hash function over other entropy inputs, if any, which you may as well try to collect directly.

So the code uses the TSC and races it against a timer, which uses the system clocksource. Guess what the system clocksource is on any modern PC? $ cat /sys/bus/clocksource/devices/clocksource0/current_clocksource tsc

Might be the LAPIC timer for events, but really, who says that stuff isn't running off of a synchronized clock? You'd have had better luck back in the days of the PIT timer, that *definitely* had its own crystal.

Then there's embedded systems which might have a grand total of one (1) quartz crystal.

And then the code starts with this gem: http://stack.now  = random_get_entropy(); /* Slow counter - or none. Don't even bother */ if (http://stack.now  == random_get_entropy()) return;

Challenge question: what happens when a "slow counter" just so happens to tick between those two calls? Yeah. You need to check 3 times, not 2 (assuming no IRQs to arbitrarily delay the check). And even then it's crude.