I will try to answer a simplified question: does there exist a feasible attack on a true CSPRNG (cryptographically secure random number generator)? And then, what if it is not a perfect CSPRNG?
To make things simple, assume no entropy is added after the initialization setup of a deterministic true CSPRNG . Also, assume no leak of information in the initialization.
From wikipedia the definition of a CSPRNG is as given as follows:
Every CSPRNG should satisfy the next-bit test. That is, given the first k bits of a random sequence, there is no polynomial-time
algorithm that can predict the (k+1)th bit with probability of success
non-negligibly better than 50%. Andrew Yao proved in 1982 that a
generator passing the next-bit test will pass all other
polynomial-time statistical tests for randomness.
Every CSPRNG should withstand "state compromise extensions". In the event that part or all of its state has been revealed (or guessed
correctly), it should be impossible to reconstruct the stream of
random numbers prior to the revelation. Additionally, if there is an
entropy input while running, it should be infeasible to use knowledge
of the input's state to predict future conditions of the CSPRNG state.
That says even if some of the random output sequence is leaked, the parts of the sequence before and after that leaked part cannot be determined.
In that case you are completely safe using
/dev/urandom, even if there is a leak of the random sequence data and even if no external random data is ever added to the sequence after initialization.
Suppose that it turns out that the so-called CSPRNG is actually broken. Just for the sale of argument suppose that given a partial leak of the sequence, both past and future parts of sequence "close enough" to the leak are severly compromised.
In such a broken-CSPRNG case, the added entropy will add safety to the system. If 256 true bits of entropy separate the leak and a random number X used for a critical purpose, then the search space for an attack on X is enlarged by 2^256 - and it is therefore totally secure.
So case 2 is a risk under the following 2 conditions:
- There is a leak of the random sequence state.
- The PRNG is not a perfect CSPRNG.
But ensuring sufficient entropy can perfectly mitigate the risk.
Concerning condition (1): the possibility of a data leak. Some Java implementations provide access to the underlying /dev/random data. It says so in the Java documentation.
That's great for choosing random numbers in Java, but it could be used by Java-based malware to leak information on your random sequence. Besides Java, every time you create a random password with your software and pass it out to an external website, that could feasibly leak some information about your random sequence state.
Concerning condition (2): while it may be possible to a prove that a particular PRNG is not a CSPRNG, it is not possible to prove that a particular PRNG is a CSPRNG. You just have to hope that the CSPRNG has not been disproven without you knowing about it. There are also shades of grey: a particular attack only opens a narrow window of vulnerability before and after a leak, and it would require huge resources to exploit it. Evaluating the risk of an unknown (to you) attack with a concrete number is difficult or impossible, but to treat the risk as an unknown variable and examine the cost of mitigation vs. consequences as the risk is varied is a meaningful exercise.
Note: There is a layman's question: If the PRNG is deterministic, how can the next bit not be predictable if a leak occurs? The answer is that although the overall random sequence algorithm itself is publicly known, the function used to transtion from one (value, state) pair to the next (value, state) pair is initially chosen from a large family of functions, e.g., one of 2^256 such functions. Then another 256 bits can be used to seed the chosen function. (Actually only 128 bits are required to intialize the