use secure random instead of common random