title: Using openssl_random_pseudo_bytes() to seed mt_rand()
body: <p>I'm trying to build a simple password generating function using <code>openssl_random_pseudo_bytes</code> and want to know if it is cryptographically strong.</p>
  
  <pre class="lang-php prettyprint-override"><code>function randomPassword($length = 12) {
      mt_srand( hexdec( bin2hex( openssl_random_pseudo_bytes(256) ) ) );
      $alphabet = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$&amp;*-_=+.?';
      $pass = '';
      $alphaLength = strlen($alphabet) - 1;
      for ($i = 0; $i &lt; $length; $i++) {
          $n = mt_rand(0, $alphaLength);
         $pass .= $alphabet[$n];
     }
     return $pass;
  }
  </code></pre>
  
  <p>I would assume that if there is a weakness that is is till in the <code>mt_rand</code> function regardless of seeding it with <code>openssl_random_pseudo_bytes</code>. However, I have been unable to find any discussion on the topic.</p>