[Cryptography] cheap sources of entropy

[John Gilmore]

So, if an attacker running malware in a hypervisor (or SMM) knew you
were depending on disk drive timings for the random numbers that
create your encryption keys, how easily could they attack you by
rigidizing those interrupt timings, e.g. delaying your virtual machine
interrupts at to the next even 1/60th of a second?

How much easier would this be if they could read the source code for
your "extract entropy from disk drive timings" code, and even adapt
their malware's behavior to various versions of that widely deployed code?

	John