Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG:
Why require an entropy source specify which pool a random event should go in?
(For code, see the
add_random_event method in this python implementation).
The book discusses why you wouldn't want to just round-robin (or similar) all events, as a compromised source could force all good data into specific pools. This makes sense.
If I'm following the discussion correctly, each entropy source spreading it's events evenly across all pools is the desired behavior. This also makes sense.
What I don't quite get is why you couldn't attach a counter or similar to each entropy source and use that bit of Fortuna-managed data to route events. Seems like that would make it harder for an evil entropy source to influence particular pools, and simplify the accumulator interface a little bit. The cost is an additional bit of state per entropy source, which doesn't seem substantial.
Now since it seems obvious to me, I suspect there is a flaw in my reasoning. So, why is pool choice delegated to the entropy source instead of managed by Fortuna?