anchor.diff:    (with-/dev/random (s)
       (read-byte s)))
   
  +(defun %shift-in (accum fix-accum fix-accum-bits fix-accum-size value bits)
  +  (cond ((>= (+ fix-accum-bits bits) fix-accum-size)
  +         (cond ((>= bits fix-accum-size)
  +                (setf accum (+ (ash accum (+ fix-accum-bits bits))
  +                               (ash fix-accum fix-accum-bits)
  +                               value)
  +                      fix-accum 0
  +                      fix-accum-bits 0))
  +               (t (setf accum (+ (ash accum fix-accum-bits) fix-accum)
  +                        fix-accum value
  +                        fix-accum-bits bits))))
  +        (t (setf fix-accum (+ (ash fix-accum bits) value))
  +           (incf fix-accum-bits bits)))
  +  (values accum fix-accum fix-accum-bits))
  +
  +(defun %shift-value (accum fix-accum fix-accum-bits)
  +  (+ (ash accum fix-accum-bits) fix-accum))
  +
  +;; Enables bit accumulation with minimal bignum consing
  +(defmacro with-shift-in (&body body)
  +  (let ((accum (gensym "ACCUM"))
  +        (fix-accum (gensym "FIX-ACCUM"))
  +        (fix-accum-bits (gensym "FIX-ACCUM-BITS"))
  +        (fix-accum-size (integer-length most-positive-fixnum)))
  +    `(let ((,accum 0)
  +           (,fix-accum 0)
  +           (,fix-accum-bits 0))
  +       (flet ((shift-in (value bits)
  +                (multiple-value-setq (,accum ,fix-accum ,fix-accum-bits)
  +                  (%shift-in ,accum ,fix-accum ,fix-accum-bits ,fix-accum-size
  +                             value bits)))
  +              (shift-value ()
  +                (prog1 (%shift-value ,accum ,fix-accum, fix-accum-bits)
  +                  (setf ,accum 0
  +                        ,fix-accum 0
  +                        ,fix-accum-bits 0))))
  +         (declare (dynamic-extent #'shift-in #'shift-value))
  +         ,@body))))
  +
  +(defun random-bits (count)
  +  "Return an integer containing COUNT random bits."
  +  (with-/dev/random (s)
  +    (cond ((>= *remainder-bits* count)
  +           (prog1 (logand (1- (ash 1 count)) *remainder*)
  +             (setf *remainder* (ash *remainder* (- count)))
  +             (decf *remainder-bits* count)))
  +          (t (let* ((full-bytes (floor (- count *remainder-bits*) 8))
  +                    (last-byte-bits (- count *remainder-bits* (* 8 full-bytes))))
  +               (with-shift-in
  +                 (shift-in *remainder* *remainder-bits*)
  +                 (dotimes (i full-bytes)
  +                   (shift-in (random-byte) 8))
  +                 (when (> last-byte-bits 0)
  +                   (let ((last-byte (random-byte)))
  +                     (shift-in (logand last-byte (1- (ash 1 last-byte-bits)))
  +                               last-byte-bits)
  +                     (setf *remainder* (ash last-byte (- last-byte-bits))
  +                           *remainder-bits* (- 8 last-byte-bits))))
  +                 (shift-value)))))))
  +
  +;; Can't just get COUNT bits and reduce to LIMIT's range.
  +;; That makes some values more likely than others.
  +;; This consumes (on average) up to twice the entropy, and time,
  +;; but gets a uniformly distributed result.
   (defun random-integer (limit)
  -  "Return a random integer >= 0 and < limit. Same as `cl:random', but better."
  +  "Return a random integer >= 0 and < limit. Same as `cl:random', but better randomness."
     (check-type limit (integer 0))
  -  (let* ((bytes (ceiling (integer-length limit) 8))
  -         (divisor (ash 1 (* 8 bytes)))
  -         (sum 0))
  -    (with-/dev/random ()
  -      (dotimes (i bytes)
  -        (setf sum (+ (ash sum 8) (random-byte))))
  -      (values (floor (* limit sum) divisor)))))
  +  (with-/dev/random ()
  +    (loop with count = (integer-length limit)
  +       for bits = (random-bits count)
  +       when (< bits limit) return bits)))
   
   )
   
  
positive.code: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
  ;;;
  ;;; Yet another cryptographically secure random number library.
  ;;; Uses /dev/random, so not for when you need it quickly.
  ;;; Just uses cl:random in Windows.
  ;;;
  
  
negative.code: (defun random-byte ()
    "(cl:random 256)"
    (random 256))
  
  (defun random-bits (count)
    "(cl-random (ash 1 count))"
    (random (ash 1 count)))
  
  (defun random-integer (limit)
    "(cl:random LIMIT)"
  