> Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs. Sure, but screwing up XORing three validated chunks together is harder than screwing up one. It wouldn’t have saved this case (which was ultimately a failure of having an insecure fallback in the code at all, which shouldn’t be allowed!), but it should be common practice. > Also as per your comment with HWW, isn't it super-hard/impossible to check the *input* to dev/urandom's CSPRNG, in practice? On Linux? Sure, that’s ultimately because it’s post-whitened/hashed which makes it hard to validate. That doesn’t mean it couldn’t be XOR’d with more but probably we should be requiring at least one “validated” input to any RNG for key generation.

I think I'm misunderstanding the mechanics. I said 'inputs' to mean exactly 'pre-whitening'. But i have no idea exactly how it would work on Linux. Claude told me yesterday that it's deliberately made almost impossible to do, which makes a lot of sense, if true. Re: 'at least one validated', yep, that seems to be the right general idea.