Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

Random Numbers

No encryption routine is capable of being better than the key it uses, and since keys depend on the availability of truly random data, we include here a brief discussion of obtaining random data. An in-depth discussion of this topic can be found in RFC 1750 (available at http://www.faqs.org/rfcs/rfc1750.html).

The main source of randomness, or entropy, on a Unix system is /dev/random. This is a software device that outputs a more or less constant stream of binary data, based on a pseudo-random number generation (PNRG) algorithm. Because pseudo-random data is predictable if the starting number is known, the PNRG algorithm is supplemented by a buffer of random data collected over time from various system values, such as network events ...