FreeBSD random number generator broken for last 4 months

> If the nonce is ever reused, bits of the private key are leaked.

It's worse than that. If the nonce can be guessed, simple math can give you the private key (see http://rdist.root.org/2009/05/17/the-debian-pgp-disaster-...). If *bits* of the nonce can be guessed, with several signatures more complicated math can give you the private key. If the same nonce is used more than once, you can find the nonce (see http://rdist.root.org/2010/11/19/dsa-requirements-for-ran...). Non-deterministic DSA is that fragile.