/dev/random uses the timings of kernel interupts to add to the entropy pool. The amount of entropy in the pool is tracked in a variable named
Here is the relevant snippet of code from
random.c. It represents the time (in jiffies I think) between the last two interupts in variable
delta and the differences in deltas as
delta = time - state->last_time; state->last_time = time; delta2 = delta - state->last_delta; state->last_delta = delta; if (delta < 0) delta = -delta; if (delta2 < 0) delta2 = -delta2; delta = MIN(delta, delta2) >> 1; for (nbits = 0; delta; nbits++) delta >>= 1; r->entropy_count += nbits; /* Prevent overflow */ if (r->entropy_count > POOLBITS) r->entropy_count = POOLBITS;
It looks like the estimate of the entropy added is essentially the floor (not ceil because of the initial bitshift before the loop) of base 2 logarithm of delta. This makes some intuitive sense, though I'm not sure what assumptions would be needed to make this formally correct.
So, my first question is "what is the reasoning behind this estimate?"
My second question is about
delta = MIN(delta, delta2) .... What does this do? Why take the minimum of this delta and the last one? I don't know what this is supposed to achieve - perhaps it makes the estimate better, maybe just more conservative.
Edit: I've found a paper that specifies the estimate, but it doesn't really give a reasoned argument for it (though it does outline some informal conditions that the estimator should meet).
Other resources that have come up in the comments: