diff --git a/src/crypto/sha512.h b/src/crypto/sha512.h
index 8195ba59f..b9e23f321 100644
--- a/src/crypto/sha512.h
+++ b/src/crypto/sha512.h
@@ -1,27 +1,27 @@
 // Copyright (c) 2014-2016 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #ifndef BITCOIN_CRYPTO_SHA512_H
 #define BITCOIN_CRYPTO_SHA512_H
 
 #include <cstdint>
 #include <cstdlib>
 
 /** A hasher class for SHA-512. */
 class CSHA512 {
 private:
     uint64_t s[8];
     uint8_t buf[128];
     uint64_t bytes;
 
 public:
-    static const size_t OUTPUT_SIZE = 64;
+    static constexpr size_t OUTPUT_SIZE = 64;
 
     CSHA512();
     CSHA512 &Write(const uint8_t *data, size_t len);
     void Finalize(uint8_t hash[OUTPUT_SIZE]);
     CSHA512 &Reset();
 };
 
 #endif // BITCOIN_CRYPTO_SHA512_H
diff --git a/src/random.cpp b/src/random.cpp
index b535d3629..dd4e37c3e 100644
--- a/src/random.cpp
+++ b/src/random.cpp
@@ -1,536 +1,552 @@
 // Copyright (c) 2009-2010 Satoshi Nakamoto
 // Copyright (c) 2009-2016 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <random.h>
 
 #ifdef WIN32
 #include <compat.h> // for Windows API
 #include <wincrypt.h>
 #endif
 #include <crypto/sha512.h>
 #include <logging.h> // for LogPrint()
 #include <support/cleanse.h>
 #include <sync.h>      // for WAIT_LOCK
 #include <util/time.h> // for GetTime()
 
 #include <openssl/err.h>
 #include <openssl/rand.h>
 
 #include <chrono>
 #include <cstdlib>
 #include <limits>
 #include <mutex>
 #include <thread>
 #ifndef WIN32
 #include <fcntl.h>
 #include <sys/time.h>
 #endif
 
 #ifdef HAVE_SYS_GETRANDOM
 #include <linux/random.h>
 #include <sys/syscall.h>
 #endif
 #if defined(HAVE_GETENTROPY) ||                                                \
     (defined(HAVE_GETENTROPY_RAND) && defined(MAC_OSX))
 #include <unistd.h>
 #endif
 #if defined(HAVE_GETENTROPY_RAND) && defined(MAC_OSX)
 #include <sys/random.h>
 #endif
 #ifdef HAVE_SYSCTL_ARND
 #include <sys/sysctl.h>
 #include <util/strencodings.h> // for ARRAYLEN
 #endif
 
 #if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
 #include <cpuid.h>
 #endif
 
 [[noreturn]] static void RandFailure() {
     LogPrintf("Failed to read randomness, aborting\n");
     std::abort();
 }
 
 static inline int64_t GetPerformanceCounter() {
 // Read the hardware time stamp counter when available.
 // See https://en.wikipedia.org/wiki/Time_Stamp_Counter for more information.
 #if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_X64))
     return __rdtsc();
 #elif !defined(_MSC_VER) && defined(__i386__)
     uint64_t r = 0;
     // Constrain the r variable to the eax:edx pair.
     __asm__ volatile("rdtsc" : "=A"(r));
     return r;
 #elif !defined(_MSC_VER) && (defined(__x86_64__) || defined(__amd64__))
     uint64_t r1 = 0, r2 = 0;
     // Constrain r1 to rax and r2 to rdx.
     __asm__ volatile("rdtsc" : "=a"(r1), "=d"(r2));
     return (r2 << 32) | r1;
 #else
     // Fall back to using C++11 clock (usually microsecond or nanosecond
     // precision)
     return std::chrono::high_resolution_clock::now().time_since_epoch().count();
 #endif
 }
 
 #if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
 static std::atomic<bool> hwrand_initialized{false};
 static bool rdrand_supported = false;
 static constexpr uint32_t CPUID_F1_ECX_RDRAND = 0x40000000;
 static void InitHardwareRand() {
     uint32_t eax, ebx, ecx, edx;
     if (__get_cpuid(1, &eax, &ebx, &ecx, &edx) && (ecx & CPUID_F1_ECX_RDRAND)) {
         rdrand_supported = true;
     }
     hwrand_initialized.store(true);
 }
 
 static void ReportHardwareRand() {
     assert(hwrand_initialized.load(std::memory_order_relaxed));
     if (rdrand_supported) {
         // This must be done in a separate function, as HWRandInit() may be
         // indirectly called from global constructors, before logging is
         // initialized.
         LogPrintf("Using RdRand as an additional entropy source\n");
     }
 }
 
 #else
 /**
  * Access to other hardware random number generators could be added here later,
  * assuming it is sufficiently fast (in the order of a few hundred CPU cycles).
  * Slower sources should probably be invoked separately, and/or only from
  * RandAddSeedSleep (which is called during idle background operation).
  */
 static void InitHardwareRand() {}
 static void ReportHardwareRand() {}
 #endif
 
 static bool GetHardwareRand(uint8_t *ent32) {
 #if defined(__x86_64__) || defined(__amd64__) || defined(__i386__)
     assert(hwrand_initialized.load(std::memory_order_relaxed));
     if (rdrand_supported) {
         uint8_t ok;
 // Not all assemblers support the rdrand instruction, write it in hex.
 #ifdef __i386__
         for (int iter = 0; iter < 4; ++iter) {
             uint32_t r1, r2;
             __asm__ volatile(".byte 0x0f, 0xc7, 0xf0;" // rdrand %eax
                              ".byte 0x0f, 0xc7, 0xf2;" // rdrand %edx
                              "setc %2"
                              : "=a"(r1), "=d"(r2), "=q"(ok)::"cc");
             if (!ok) {
                 return false;
             }
             WriteLE32(ent32 + 8 * iter, r1);
             WriteLE32(ent32 + 8 * iter + 4, r2);
         }
 #else
         uint64_t r1, r2, r3, r4;
         __asm__ volatile(".byte 0x48, 0x0f, 0xc7, 0xf0, " // rdrand %rax
                          "0x48, 0x0f, 0xc7, 0xf3, "       // rdrand %rbx
                          "0x48, 0x0f, 0xc7, 0xf1, "       // rdrand %rcx
                          "0x48, 0x0f, 0xc7, 0xf2; "       // rdrand %rdx
                          "setc %4"
                          : "=a"(r1), "=b"(r2), "=c"(r3), "=d"(r4),
                            "=q"(ok)::"cc");
         if (!ok) {
             return false;
         }
         WriteLE64(ent32, r1);
         WriteLE64(ent32 + 8, r2);
         WriteLE64(ent32 + 16, r3);
         WriteLE64(ent32 + 24, r4);
 #endif
         return true;
     }
 #endif
     return false;
 }
 
 void RandAddSeed() {
     // Seed with CPU performance counter
     int64_t nCounter = GetPerformanceCounter();
     RAND_add(&nCounter, sizeof(nCounter), 1.5);
     memory_cleanse((void *)&nCounter, sizeof(nCounter));
 }
 
 static void RandAddSeedPerfmon() {
     RandAddSeed();
 
 #ifdef WIN32
     // Don't need this on Linux, OpenSSL automatically uses /dev/urandom
     // Seed with the entire set of perfmon data
 
     // This can take up to 2 seconds, so only do it every 10 minutes
     static int64_t nLastPerfmon;
     if (GetTime() < nLastPerfmon + 10 * 60) {
         return;
     }
     nLastPerfmon = GetTime();
 
     std::vector<uint8_t> vData(250000, 0);
     long ret = 0;
     unsigned long nSize = 0;
     // Bail out at more than 10MB of performance data
     const size_t nMaxSize = 10000000;
     while (true) {
         nSize = vData.size();
         ret = RegQueryValueExA(HKEY_PERFORMANCE_DATA, "Global", nullptr,
                                nullptr, vData.data(), &nSize);
         if (ret != ERROR_MORE_DATA || vData.size() >= nMaxSize) {
             break;
         }
         // Grow size of buffer exponentially
         vData.resize(std::max((vData.size() * 3) / 2, nMaxSize));
     }
     RegCloseKey(HKEY_PERFORMANCE_DATA);
     if (ret == ERROR_SUCCESS) {
         RAND_add(vData.data(), nSize, nSize / 100.0);
         memory_cleanse(vData.data(), nSize);
     } else {
         // Performance data is only a best-effort attempt at improving the
         // situation when the OS randomness (and other sources) aren't
         // adequate. As a result, failure to read it is isn't considered
         // critical, so we don't call RandFailure().
         // TODO: Add logging when the logger is made functional before global
         // constructors have been invoked.
     }
 #endif
 }
 
 #ifndef WIN32
 /**
  * Fallback: get 32 bytes of system entropy from /dev/urandom. The most
  * compatible way to get cryptographic randomness on UNIX-ish platforms.
  */
 static void GetDevURandom(uint8_t *ent32) {
     int f = open("/dev/urandom", O_RDONLY);
     if (f == -1) {
         RandFailure();
     }
     int have = 0;
     do {
         ssize_t n = read(f, ent32 + have, NUM_OS_RANDOM_BYTES - have);
         if (n <= 0 || n + have > NUM_OS_RANDOM_BYTES) {
             close(f);
             RandFailure();
         }
         have += n;
     } while (have < NUM_OS_RANDOM_BYTES);
     close(f);
 }
 #endif
 
 /** Get 32 bytes of system entropy. */
 void GetOSRand(uint8_t *ent32) {
 #if defined(WIN32)
     HCRYPTPROV hProvider;
     int ret = CryptAcquireContextW(&hProvider, nullptr, nullptr, PROV_RSA_FULL,
                                    CRYPT_VERIFYCONTEXT);
     if (!ret) {
         RandFailure();
     }
     ret = CryptGenRandom(hProvider, NUM_OS_RANDOM_BYTES, ent32);
     if (!ret) {
         RandFailure();
     }
     CryptReleaseContext(hProvider, 0);
 #elif defined(HAVE_SYS_GETRANDOM)
     /**
      * Linux. From the getrandom(2) man page:
      * "If the urandom source has been initialized, reads of up to 256 bytes
      * will always return as many bytes as requested and will not be interrupted
      * by signals."
      */
     int rv = syscall(SYS_getrandom, ent32, NUM_OS_RANDOM_BYTES, 0);
     if (rv != NUM_OS_RANDOM_BYTES) {
         if (rv < 0 && errno == ENOSYS) {
             /* Fallback for kernel <3.17: the return value will be -1 and errno
              * ENOSYS if the syscall is not available, in that case fall back
              * to /dev/urandom.
              */
             GetDevURandom(ent32);
         } else {
             RandFailure();
         }
     }
 #elif defined(HAVE_GETENTROPY) && defined(__OpenBSD__)
     /**
      * On OpenBSD this can return up to 256 bytes of entropy, will return an
      * error if more are requested.
      * The call cannot return less than the requested number of bytes.
      * getentropy is explicitly limited to openbsd here, as a similar (but not
      * the same) function may exist on other platforms via glibc.
      */
     if (getentropy(ent32, NUM_OS_RANDOM_BYTES) != 0) {
         RandFailure();
     }
 #elif defined(HAVE_GETENTROPY_RAND) && defined(MAC_OSX)
     // We need a fallback for OSX < 10.12
     if (&getentropy != nullptr) {
         if (getentropy(ent32, NUM_OS_RANDOM_BYTES) != 0) {
             RandFailure();
         }
     } else {
         GetDevURandom(ent32);
     }
 #elif defined(HAVE_SYSCTL_ARND)
     /**
      * FreeBSD and similar. It is possible for the call to return less bytes
      * than requested, so need to read in a loop.
      */
     static const int name[2] = {CTL_KERN, KERN_ARND};
     int have = 0;
     do {
         size_t len = NUM_OS_RANDOM_BYTES - have;
         if (sysctl(name, ARRAYLEN(name), ent32 + have, &len, nullptr, 0) != 0) {
             RandFailure();
         }
         have += len;
     } while (have < NUM_OS_RANDOM_BYTES);
 #else
     /**
      * Fall back to /dev/urandom if there is no specific method implemented to
      * get system entropy for this OS.
      */
     GetDevURandom(ent32);
 #endif
 }
 
 void GetRandBytes(uint8_t *buf, int num) {
     if (RAND_bytes(buf, num) != 1) {
         RandFailure();
     }
 }
 
 namespace {
 struct RNGState {
     Mutex m_mutex;
     uint8_t m_state[32] GUARDED_BY(m_mutex) = {0};
     uint64_t m_counter GUARDED_BY(m_mutex) = 0;
 
     RNGState() { InitHardwareRand(); }
+
+    /**
+     * Extract up to 32 bytes of entropy from the RNG state, mixing in new
+     * entropy from hasher.
+     */
+    void MixExtract(uint8_t *out, size_t num, CSHA512 &&hasher) {
+        assert(num <= 32);
+        uint8_t buf[64];
+        static_assert(sizeof(buf) == CSHA512::OUTPUT_SIZE,
+                      "Buffer needs to have hasher's output size");
+        {
+            LOCK(m_mutex);
+            // Write the current state of the RNG into the hasher
+            hasher.Write(m_state, 32);
+            // Write a new counter number into the state
+            hasher.Write((const uint8_t *)&m_counter, sizeof(m_counter));
+            ++m_counter;
+            // Finalize the hasher
+            hasher.Finalize(buf);
+            // Store the last 32 bytes of the hash output as new RNG state.
+            memcpy(m_state, buf + 32, 32);
+        }
+        // If desired, copy (up to) the first 32 bytes of the hash output as
+        // output.
+        if (num) {
+            assert(out != nullptr);
+            memcpy(out, buf, num);
+        }
+        // Best effort cleanup of internal state
+        hasher.Reset();
+        memory_cleanse(buf, 64);
+    }
 };
 
 RNGState &GetRNGState() {
     // This C++11 idiom relies on the guarantee that static variable are
     // initialized on first call, even when multiple parallel calls are
     // permitted.
     static std::unique_ptr<RNGState> g_rng{new RNGState()};
     return *g_rng;
 }
 } // namespace
 
-static void AddDataToRng(void *data, size_t len);
+static void AddDataToRng(void *data, size_t len, RNGState &rng);
 
 void RandAddSeedSleep() {
+    RNGState &rng = GetRNGState();
+
     int64_t nPerfCounter1 = GetPerformanceCounter();
     std::this_thread::sleep_for(std::chrono::milliseconds(1));
     int64_t nPerfCounter2 = GetPerformanceCounter();
 
     // Combine with and update state
-    AddDataToRng(&nPerfCounter1, sizeof(nPerfCounter1));
-    AddDataToRng(&nPerfCounter2, sizeof(nPerfCounter2));
+    AddDataToRng(&nPerfCounter1, sizeof(nPerfCounter1), rng);
+    AddDataToRng(&nPerfCounter2, sizeof(nPerfCounter2), rng);
 
     memory_cleanse(&nPerfCounter1, sizeof(nPerfCounter1));
     memory_cleanse(&nPerfCounter2, sizeof(nPerfCounter2));
 }
 
-static void AddDataToRng(void *data, size_t len) {
-    RNGState &rng = GetRNGState();
-
+static void AddDataToRng(void *data, size_t len, RNGState &rng) {
     CSHA512 hasher;
     hasher.Write((const uint8_t *)&len, sizeof(len));
     hasher.Write((const uint8_t *)data, len);
-    uint8_t buf[64];
-    {
-        WAIT_LOCK(rng.m_mutex, lock);
-        hasher.Write(rng.m_state, sizeof(rng.m_state));
-        hasher.Write((const uint8_t *)&rng.m_counter, sizeof(rng.m_counter));
-        ++rng.m_counter;
-        hasher.Finalize(buf);
-        memcpy(rng.m_state, buf + 32, 32);
-    }
-    memory_cleanse(buf, 64);
+    rng.MixExtract(nullptr, 0, std::move(hasher));
 }
 
 void GetStrongRandBytes(uint8_t *out, int num) {
     RNGState &rng = GetRNGState();
 
     assert(num <= 32);
     CSHA512 hasher;
     uint8_t buf[64];
 
     // First source: OpenSSL's RNG
     RandAddSeedPerfmon();
     GetRandBytes(buf, 32);
     hasher.Write(buf, 32);
 
     // Second source: OS RNG
     GetOSRand(buf);
     hasher.Write(buf, 32);
 
     // Third source: HW RNG, if available.
     if (GetHardwareRand(buf)) {
         hasher.Write(buf, 32);
     }
 
     // Combine with and update state
-    {
-        WAIT_LOCK(rng.m_mutex, lock);
-        hasher.Write(rng.m_state, sizeof(rng.m_state));
-        hasher.Write((const uint8_t *)&rng.m_counter, sizeof(rng.m_counter));
-        ++rng.m_counter;
-        hasher.Finalize(buf);
-        memcpy(rng.m_state, buf + 32, 32);
-    }
+    rng.MixExtract(out, num, std::move(hasher));
 
     // Produce output
     memcpy(out, buf, num);
     memory_cleanse(buf, 64);
 }
 
 uint64_t GetRand(uint64_t nMax) {
     if (nMax == 0) {
         return 0;
     }
 
     // The range of the random source must be a multiple of the modulus to give
     // every possible output value an equal possibility
     uint64_t nRange = (std::numeric_limits<uint64_t>::max() / nMax) * nMax;
     uint64_t nRand = 0;
     do {
         GetRandBytes((uint8_t *)&nRand, sizeof(nRand));
     } while (nRand >= nRange);
     return (nRand % nMax);
 }
 
 int GetRandInt(int nMax) {
     return GetRand(nMax);
 }
 
 uint256 GetRandHash() {
     uint256 hash;
     GetRandBytes((uint8_t *)&hash, sizeof(hash));
     return hash;
 }
 
 void FastRandomContext::RandomSeed() {
     uint256 seed = GetRandHash();
     rng.SetKey(seed.begin(), 32);
     requires_seed = false;
 }
 
 uint256 FastRandomContext::rand256() {
     if (bytebuf_size < 32) {
         FillByteBuffer();
     }
     uint256 ret;
     memcpy(ret.begin(), bytebuf + 64 - bytebuf_size, 32);
     bytebuf_size -= 32;
     return ret;
 }
 
 std::vector<uint8_t> FastRandomContext::randbytes(size_t len) {
     if (requires_seed) {
         RandomSeed();
     }
     std::vector<uint8_t> ret(len);
     if (len > 0) {
         rng.Output(&ret[0], len);
     }
     return ret;
 }
 
 FastRandomContext::FastRandomContext(const uint256 &seed)
     : requires_seed(false), bytebuf_size(0), bitbuf_size(0) {
     rng.SetKey(seed.begin(), 32);
 }
 
 bool Random_SanityCheck() {
     uint64_t start = GetPerformanceCounter();
 
     /**
      * This does not measure the quality of randomness, but it does test that
      * OSRandom() overwrites all 32 bytes of the output given a maximum number
      * of tries.
      */
     static const ssize_t MAX_TRIES = 1024;
     uint8_t data[NUM_OS_RANDOM_BYTES];
     /* Tracks which bytes have been overwritten at least once */
     bool overwritten[NUM_OS_RANDOM_BYTES] = {};
     int num_overwritten;
     int tries = 0;
     /**
      * Loop until all bytes have been overwritten at least once, or max number
      * tries reached.
      */
     do {
         memset(data, 0, NUM_OS_RANDOM_BYTES);
         GetOSRand(data);
         for (int x = 0; x < NUM_OS_RANDOM_BYTES; ++x) {
             overwritten[x] |= (data[x] != 0);
         }
 
         num_overwritten = 0;
         for (int x = 0; x < NUM_OS_RANDOM_BYTES; ++x) {
             if (overwritten[x]) {
                 num_overwritten += 1;
             }
         }
 
         tries += 1;
     } while (num_overwritten < NUM_OS_RANDOM_BYTES && tries < MAX_TRIES);
     /* If this failed, bailed out after too many tries */
     if (num_overwritten != NUM_OS_RANDOM_BYTES) {
         return false;
     }
 
     // Check that GetPerformanceCounter increases at least during a GetOSRand()
     // call + 1ms sleep.
     std::this_thread::sleep_for(std::chrono::milliseconds(1));
     uint64_t stop = GetPerformanceCounter();
     if (stop == start) {
         return false;
     }
 
     // We called GetPerformanceCounter. Use it as entropy.
     RAND_add((const uint8_t *)&start, sizeof(start), 1);
     RAND_add((const uint8_t *)&stop, sizeof(stop), 1);
 
     return true;
 }
 
 FastRandomContext::FastRandomContext(bool fDeterministic)
     : requires_seed(!fDeterministic), bytebuf_size(0), bitbuf_size(0) {
     if (!fDeterministic) {
         return;
     }
     uint256 seed;
     rng.SetKey(seed.begin(), 32);
 }
 
 FastRandomContext &FastRandomContext::
 operator=(FastRandomContext &&from) noexcept {
     requires_seed = from.requires_seed;
     rng = from.rng;
     std::copy(std::begin(from.bytebuf), std::end(from.bytebuf),
               std::begin(bytebuf));
     bytebuf_size = from.bytebuf_size;
     bitbuf = from.bitbuf;
     bitbuf_size = from.bitbuf_size;
     from.requires_seed = true;
     from.bytebuf_size = 0;
     from.bitbuf_size = 0;
     return *this;
 }
 
 void RandomInit() {
     // Invoke RNG code to trigger initialization (if not already performed)
     GetRNGState();
 
     ReportHardwareRand();
 }