and can test these random number generators. In January 2014, Daniel J. Bernstein published a critique of how Linux mixes different sources of entropy. He outlines an attack in which one source of entropy capable of monitoring the other sources of entropy could modify its output to nullify the randomness of the other sources of entropy. Consider the function where H is a hash function and x, y, and z are sources of entropy with z being the output of a CPU based malicious HRNG Z: Z generates a random value of r. Z computes . If the output of is equal to the desired value, output r as z. Else, repeat starting at 1. Bernstein estimated that an attacker would need to repeat 16 times to compromise DSA and ECDSA. This is possible because Linux reseeds H on an ongoing basis instead of using a single high quality seed. In October 2016, with the release of Linux kernel version 4.8, the kernel's was switched over to a ChaCha20-based cryptographic pseudorandom number generator (CPRNG) implementation by Theodore Ts'o, based on Bernstein's well-regarded stream cipher ChaCha20. In 2020, the Linux kernel version 5.6 only blocks when the CPRNG hasn't initialized. Once initialized, and behave the same. BSD systems The FreeBSD operating system provides a link to . Both block only until properly seeded. FreeBSD's PRNG (Fortuna) reseeds regularly, and does not attempt to estimate entropy. On a system with small amount of network and disk activity, reseeding is done after a fraction of a second. Since OpenBSD 5.1 (May 1, 2012) and used an algorithm based on RC4 but renamed to ARC4 because of intellectual property reasons. While random number generation here uses system entropy gathered in several ways, the ARC4 algorithm provides a fail-safe, ensuring that a rapid and high quality pseudo-random number stream is provided even when the pool is in a low entropy state. The system automatically uses hardware random number generators (such as those provided on some Intel PCI hubs) if they are available, through the OpenBSD Cryptographic Framework. As of OpenBSD 5.5 (May 1, 2014), the call used for OpenBSD's random devices no longer uses ARC4, but ChaCha20 (arc4random name might be reconsidered as A Replacement Call for Random). was removed in OpenBSD 6.3 (April 15, 2018). NetBSD's implementation of the legacy API has been switched over to ChaCha20 as well. macOS, iOS and other Apple