For a “normal” computer user, does it make a difference to have a good entropy source?

Question

Let's take, for example, Linux. From my understanding, there are different sources and different ways that can be used to gather entropy (RNG daemon, Intel rrandr, TPM, etc). Some produce entropy that is of "better quality" than others. But, does it actually matter for a "normal" user?

(Let's say a user that only uses web browsers, office programs, and a password manager).

In which cases does the computer use entropy from the pool?

• Does it uses it when browsing https websites?

• Does it uses it when encrypting a file with 7zip or with a password manager?

Answer 1

For most cases, randomness quality is overrated.

Yes, it's important, can lead to some nasty consequences if done wrong, but there are so many easier mistakes that random quality would be at the end of your list of worries:

• OS bugs
• Browser bugs
• Bad WiFi password
• Password reuse
• Default or hard-coded router passwords

The list is long. If you are affected by one of those, you lose. Exploiting the RNG to steal information is impractical if the attacker can exploit one of those issues. Breaking the RNG should be the last resort.

You must calculate the price to protect versus the information value. The attacker does the same. If you are not using the imperfect PRNG to protect something very valuable, you are good to go. Don't use it to generate a bank certificate, a Bitcoin wallet with a lot of coins, things like that.

Protecting a 7zip file or navigating using HTTPS will not be much more secure if you use a built-in PRNG or CloudFlare Lava Lamp RNG.