uses cryptographically secure random number generator