title: Secure random number generation in PHP
body: <p>Use case: the "I forgot my password" button. We can't find the user's original password because it's stored in hashed form, so the only thing to do is generate a new random password and e-mail it to him. This requires cryptographically unpredictable random numbers, for which mt_rand is not good enough, and in general we can't assume a hosting service will provide access to the operating system to install a cryptographic random number module etc. so I'm looking for a way to generate secure random numbers in PHP itself.</p>
  
  <p>The solution I've come up with so far involves storing an initial seed, then for each call,</p>
  
  <pre><code>result = seed
  seed = sha512(seed . mt_rand())
  </code></pre>
  
  <p>This is based on the security of the sha512 hash function (the mt_rand call is just to make life a little more difficult for an adversary who obtains a copy of the database).</p>
  
  <p>Am I missing something, or are there better known solutions?</p>