Fortuna

Designed by Schneier and Ferguson (2003). Used in macOS, FreeBSD, Apple secure enclave.

Fortuna's idea: 32 separate ENTROPY POOLS that fill at different rates. Reseed pulls from a varying number depending on confidence.

Pool 0: filled fastest; small reseeds frequently
Pool 1: filled half as often
Pool 2: 1/4 as often
...
Pool 31: filled rarely; for major reseeds

Each entropy event is hashed into a CHOSEN POOL (round-robin). Reseeds use only the pools that are "ready" (have new entropy since last reseed).

Why this design? Defends against:

• Output deduction: knowing some output doesn't help predict future after reseed.
• State compromise: reseeding from many pools restarts security even if previous state was leaked.
• Attacker controlling entropy sources: any pool with REAL entropy contributes; attacker-controlled pools don't poison the result.

Apple's implementation extends this with hardware RNG bootstrapping at boot — pool 0 has thousands of bits before the first reseed. Crashes during boot are the only realistic attack vector.

Modern kernels (Linux 5.18+) use a similar multi-pool design (BLAKE2 instead of SHA).