clear. These features somewhat decrease the chances of implementation errors. Yarrow was created using an attack-oriented design process. The entropy estimation of Yarrow is very conservative, thus preventing exhaustive search attacks. It is very common that PRNGs fail in real-world applications due to entropy overestimation and guessable starting points. The reseeding process of Yarrow is relatively computationally expensive, thus the cost of attempting to guess the PRNG's key is higher. Yarrow uses functions to simplify the management of seed files, thus the files are constantly updated. To handle cryptanalytic attacks, Yarrow is designed to be based on a block cipher that is secured. The level of security of the generation mechanism depends on the block cipher. Yarrow tries to avoid data-dependent execution paths. This is done to prevent side-channel attacks such as timing attacks and power analysis. This is an improvement compared to earlier PRNGs, for example RSAREF 2.0 PRNG, that will completely fall apart once additional information about the internal operations are no longer secured. Yarrow uses cryptographic hash functions to process input samples, and then uses a secure update function to combine the samples with the existing key. This makes sure that the attacker cannot easily manipulate the input samples. PRNGs such as RSAREF 2.0 PRNG do not have the ability to resist this kind of chosen-input attack. Unlike ANSI X9.17 PRNG, Yarrow has the ability to recover from a key compromise. This means that even when the key is compromised, the attacker will not be able to predict future outputs forever. This is due to the reseeding mechanism of Yarrow. Yarrow has the entropy samples pool separated from the key, and only reseeds the key when the entropy pool content is completely unpredictable. This design prevents iterative guessing attacks, where an attacker with the key guesses the next sample and checks the result by observing the next output. Cons Yarrow depends on SHA-1, a hash that has been broken since Yarrow's publication and is no longer secure. Since the outputs of Yarrow are cryptographically derived, the systems that use those outputs can only be as secure as the generation mechanism itself. That means the attacker who can break the generation mechanism will easily break a system that depends on Yarrow's outputs. This problem cannot be solved by increasing entropy accumulation. Yarrow requires entropy estimation, which is a very big challenge for implementations. It is hard to be