Does watching videos (either online videos such as off youtube or saved locally) generate enough (if any) entropy to create secure encryption keys? I understand that some activities such as memory usage, disk access, network utilization, using the mouse and keyboard, etc... generate entropy under Linux. What I don't know is if using the CPU and GPU also generates entropy? I also don't know if this is the same under Windows.
It does, but it's practically impossible to evaluate how much: just a tiny little bit, or enough for security?
A PC is an extremely complex thing, and it's practically impossible to know its exact state at a precise moment in time, even having observed its external behavior (user actions, network packets…) very precisely. Even knowing the exact state of the CPU alone is very difficult: it's very difficult to build a cycle-accurate simulator for the CPU of a modern PC or smartphone, much more difficult than building a simulator that implements all the operations but not their precise timing. Furthermore such complex chips have multiple clocks, and there is some unavoidable manufacturing imprecision that causes a drift between those clocks (CPU jitter), which is the basis of HAVEGE.
The problem with relying solely on the entropy from jitter (within the CPU and between peripherals) is that it's unreliable. Depending on the system configuration, on how much activity there is, on the ambient temperature, there may be more or less jitter. The entropy from user input is unreliable because the user may be somewhat predictable and may be observable. The entropy from network input is suspect because an adversary may be able to obtain it (e.g. if they control your Internet access because you're in a cybercafé or because they breached your router's 5-year old unpatched firmware).
All of these methods have the problem that shortly after boot, no or little entropy has had time to accumulate; a way to counter this is to save entropy from past runs in a file, and load that at boot time. This way, there may be a lack of entropy during the system installation, but as soon as the system has accumulated enough entropy for security, it keeps that entropy forever.
Operating systems like Linux and Windows mix all the entropy sources inside the kernel and expose it through system calls or similar methods (modern interfaces:
BCryptGenRandom(); deprecated interfaces:
CryptGenRandom()). The entropy you get from those system interfaces is more reliable than anything you could cobble up on your own, and is at least as trustworthy since it's coming from the operating system kernel which you have to trust anyway.
Fortunately modern systems, at least in the PC/smartphone range, have a built-in hardware random generator that is actually designed to produce entropy. The system mixes in all the entropy from various sources, which (barring bugs in the entropy mixing) gives you entropy that's at least as strong as the strongest source. While sources such as user activity and disk jitter are mixed in, it doesn't matter if they don't provide enough entropy, since the hardware RNG is sufficient on its own.
Or course it does. That's the foundational basis of
I'm not going to repeat what's already well documented. Please read Documentation and Analysis of the Linux Random Number Generator.
What's not really spelt out is where the entropy comes from. It comes from quantization noise. It's the attempt of digital systems to accurately model analogue events. There is also the Observer Effect which is a principal concept in physics. If you measure it, you change it.
The two conflate so that sampling you shoving your mouse about at a resolution of 4 GHz, or 250 trillionth of one second means that good entropy is generated. CPU, GPU, Tablet, mobile phone or washing machine are all the same.
Stick a randomness extractor on the output, and so come your secure encryption keys.