  `OK, let me try to explain some of these issues.First of all, consider how the MD5 or SHA hash function works.  (We'reusing SHA, not MD5, but at a high level they have the same interface).It takes some large amount of data, in blocks of 64 bytes, and produces16 (or in the SHA 20) bytes of hash output.Since the size of the input type is much larger than the output type,there will of course be many cases where two input texts, X and X'produce the same MD5 or SHA checksum.  The design criteria of a cryptochecksum like MD5 or SHA is this:	* Given some input text X, there is no method better than brute		force guessing of finding another input text X' which		has MD5/SHA checksum as X.  (Where brute force guessing		will take 2**64 tries for MD5, and 2**80 tries for SHA.)	* Given some MD5/SHA checksum C, there is no method better than		brute force guessing of finding some input text X where 		f(X) == C. Since it is considered extremely hard (2**64 is a very large number),all you need to do in order to "prove" that MD5 is broken is to presenttwo input texts which hash to the same MD5 value.Now, we're not using SHA in a traditional way a crypto checksum getsused, though.  Here, we have a pool which contains 4096 bits.  At thesimplest level (taking out all of the other design tricks which makeslife *harder*), Each time we want to extract 40 bits of entropy, wecompute the hash of the entire pool, which for SHA is 80 bits.  We thenfold the result in half using XOR, and so we only end up revealing 40bits of information about the actual hash value of the pool.  Theoriginal hash value is then mixed into the pool using a GeneralizedFeedback Shift Register.  Now then, "breaking" the generator involves trying to figure out theinternal state of the entropy pool given only the output from the randomnumber generator.  To analyze the worst case, we assume that we're notgetting any additional input into the entropy pool from interrupts, etc.Obviously, if you only know 40 bits of information generated from asingle extract operation, there's not enough information to deduce thestate of the 4096 bit pool.  And even with MD5, no one has managed howto devise an algorithm which can find a *single* candidate input textwhich when hashed produces a particular hash value.  Here, the attackeronly knows half the information of the hash value, and it doesn't matterif the attacker can find some particular input text value; the attackhas the find the *right* input text value which corresponds to theentropy pool.Hence, even if someone were to announce that they had broken MD5 or SHA,they still would not have necessarily broken the random numbergenerator, even if you give them the simplest version of the problemwith a lobotimized random number generator as described above.Obviously, someone wouldn't have a prayer of even trying to break theoutput of the random number generator unless they had obtained at least4096 bits.   That's simply a matter of phyics --- or in this case,mathematics.  But that's assuming that the mixing and hashing processwas "perfect" in that each time it revealed 40 bits of new informationabout the original hash pool state.  Hence, this is almost certainly much, much harder than doing atraditional cryptoanlysis on a cipher key.  A brute force attack wouldinvolve trying every single permutation of the original 4096 entropypool to see if you can find the one which generates the random stream.This would take on average 2**2048 tries, which is a very, very, very,large number.  It may be possible to find a correlation attack whichwould take less time, but certainly no one has derived one to date, anddoing so would require a theoretical breakthrough that would render SHAuseless as a cryptographic hash function.  (In fact, it would probablyrequire several theoretical breakthroughs, of which the first one wouldrender SHA useless.)  While this could happen, I suspect it is fairlyunlikely that it will.						- Ted`   