Entropy Requirements for Encryption Quality of RNGs is an important issue. 

As a very basic question I would like to understand, how "poor" entropy of a RNG can help an attacker to find out the whole secret.

In my naive view, even is a RNG (e.g. of 128 Bit) is not perfect in terms of entropy, but deviates, lets say ~0.1 % from the perfect value 128, so that it has only Entropy 127, how can an attacker find the key? Guessing the remaining 127 Bits would also be an infeasible task - ??? So what can he practically do?

I would also appreciate a good source for reading.

thanks ;-)
For example, assume an RNG spits 128-bit values $X$ that are all-zero with odds $p=1/120$, and otherwise independent and evenly distributed among the other values. The 128-bit values spit by this RNG contain $H(X)=-p\log_2(p)-(1-p)\log_2\big((1-p)/(2^{128}-1)\big)&gt;127$ bits of entropy. 

Yet, if repeatedly the same secret is XOR-ed with this RNG forming 128-bit ciphertext blocks, the secret can be recovered, with overwhelming odds, as the first value that repeats; and there are better than even odds that this occurs with a mere 250 ciphertexts.



Another example would be a 128-bit RNG where each bit is independent with odds $p=9/20$ to be one, for $H(X)=-128\big(p\log_2(p)+(1-p)\log_2(1-p)\big)&gt;127$ bits of entropy.

With the same hypothesis as in the first example, the secret can be recovered by keeping the most frequent bit value for each rank. Few hundred ciphertexts are enough to recover the secret with fair odds.

Note: the generator of the second example is still safe to generate AES-128 keys; while the first is disastrous; which illustrates that entropy is not the only thing that matters for a RNG.