c++ - how to find the "true" entropy of std::random_device?

Question

I want to check whether my implementation of std::random_device has non-zero entropy (i.e. is non-deterministic), using std::random_device::entropy() function. However, according to cppreference.com

"This function is not fully implemented in some standard libraries. For example, gcc and clang always return zero even though the device is non-deterministic. In comparison, Visual C++ always returns 32, and boost.random returns 10."

Is there any way of finding the real entropy? In particular, do modern computers (MacBook Pro/iMac etc) have a non-deterministic source or randomness, like e.g. using heat dissipation monitors?

Answer 1

I recommend you the lecture of this article.

Myths about /dev/urandom

§ 26.5.6

A random_device uniform random number generator produces non-deterministic random numbers.

If implementation limitations prevent generating non-deterministic random numbers, the implementation may employ a random number engine.

So basically it will try to use the internal system "true" random number generator, in linux /dev/{u}random o windows RltGenRandom.

A different point is you don't trust those sources of randomness because they depend on internal noise or are close implementations.

Additionally is how do you meassure the quality of entropy, as you know that is one of the biggest problem trying to find good rng generators.

One estimation could be extremely good and other estimation could report not so good entropy.

Entropy Estimation

In various science/engineering applications, such as independent component analysis, image analysis, genetic analysis, speech recognition, manifold learning, and time delay estimation it is useful to estimate the differential entropy of a system or process, given some observations.

As it sais, you must rely on final observations, and those can be wrong.

I you think the internal rng is not good enough, you can always try to buy hardware devices for that purpose. This list on wikipedia has a list of vendors, you can check on the internet reviews about them.

Performance

One point you must consider is the performance within your application using real random number generators. One common technique is to use as seed in a mersenne twister a number obtained using /dev/random.

If the user can't access your system physically, you will need to balance reliability with availability, a system with security holes is as bad as one doesn't work, at the end you must have your important data encrypted.

Edit 1: As suggestion I have moved the article at the top of my comment, is a good read. Thanks for the hint :-).