HMAC_DRBG: note that the initial seeding grabs entropy for the nonce
diff --git a/include/mbedtls/hmac_drbg.h b/include/mbedtls/hmac_drbg.h
index 2a97ae9..aa93dc9 100644
--- a/include/mbedtls/hmac_drbg.h
+++ b/include/mbedtls/hmac_drbg.h
@@ -224,6 +224,9 @@
* \brief This function sets the amount of entropy grabbed on each
* seed or reseed.
*
+ * During the initial seeding, mbedtls_hmac_drbg_seed() additionally grabs
+ * half this amount to create the nonce.
+ *
* The default value is given by the security strength, which depends on the
* hash used. See the documentation of mbedtls_hmac_drbg_seed() for details.
*