zamgo/PHPCoinAddress — pull request #1 by scintill (2013-11-30 01:41:50+00:00)
Title: Use openssl_random_pseudo_bytes() for private keys

The [PHP documentation for `mt_rand()`](http://us3.php.net/function.mt-rand) states
> **Caution** This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a cryptographically secure value, consider using openssl_random_pseudo_bytes() instead.

Thanks goes to [Andres Home for raising this issue](http://sourceforge.net/mailarchive/message.php?msg_id=31568894).

`openssl_random_pseudo_bytes()` may not work on all configurations, but I think it is important to have a more secure default than `mt_rand()`. [This article](http://phpsecurity.readthedocs.org/en/latest/Insufficient-Entropy-For-Random-Values.html) has more information and pointers for reliable, secure key generation in PHP.

This also ensures that keys are less than order(G) in a way that doesn't discard a lot of keyspace.

(Full disclosure: I wrote the "gist" this is based on, which also abused `mt_rand()`.)