yarrow

FreeBSD and OSX use Yarrow for /dev/random and /dev/urandom, with absolutely no difference in behavior between /dev/random and /dev/urandom.

But if it's broken, then FreeBSD Yarrow will also not be robust in the face of the cold start problem.

That's why Fortuna got rid of all that estimating that its predecessor Yarrow still did.

It's also worth noting that Yarrow is a Ferguson/Kelsey design, and Ferguson has foresworn entropy estimation; hence Fortuna, his newer design.

I know that on osx atleast, Yarrow kind of shields the fact that /dev/urandom and /dev/random produce non-blocking RNG.

FreeBSD, for instance, uses Yarrow and doesn't distinguish between urandom and random.

I'm experimenting with yarrow in some problem areas on our property: a hot dry and sandy septic bed and some embankments with crappy soil.

With a cryptographic primitive like Yarrow finding this precisely right way should be infeasible, in the same way that finding a collision for a cryptographic hash function should be infeasible.

(C) Randomly (dice, cards, yarrow stalks whatever is theologically permissible) quit using a channel.

The current software implementation, introduced in FreeBSD 5.0, is a complete rewrite by Mark R V Murray, and is an implementation of the Yarrow algorithm by Bruce Schneier, et al.

It describes the key idea in Yarrow and Fortuna as "simple but brilliant", and finds that Fortuna does its job rather well.

A good place to get your bearings on this is Kelsey et al's "Yarrow" paper.

It's something that if we can add to a design, I'll certainly do it --- and indeed there is a Yarrow-style "catastrophic reseeding" in the /dev/random design.

> * traditional children's stories and fairy tales were actually deliberately meant to traumatize children, to get them ready for harsh reality.* In Peter Paul & Mary's concert album, Peter Yarrow introduced the hilarious satire "Blue" with a similar riff.

Yarrow relied upon entropy estimates to recover from state compromise.

Yarrow can be mowed much less frequently, looks amazing (better than grass), grows on any soil, chokes out weeds, and doesn't need watering.

Note that the implementation of the systems' entropy pools is also quite different -- my understanding is that FreeBSD uses Yarrow, a pRNG, to feed /dev/random, while Linux mixes bits of 'real' random data together, without the extra pRNG stage.