From https://secure.php.net/manual/en/function.random-int.php:
The sources of randomness used for this function are as follows:
- On Windows, » CryptGenRandom() will always be used.
- On Linux, the » getrandom(2) syscall will be used if available.
- On other platforms, /dev/urandom will be used.
- If none of the aforementioned sources are available, then an Exception will be thrown.
About the algorithms from the list:
- CryptGenRandom is a software based pseudo random algorithm
- getrandom(2) and /dev/urandom draw their randomness from the noise on the physical devices on the machine
In your hosting's case, none if available, so an Exception
is thrown (I've never seen this before, it might mean your hosting provider is not great).
What you may be able to use instead, and what I would recommend instead of random_int
, is openssl_random_pseudo_bytes. It requires the Openssl library to be compiled in, which is a norm.
Note; the aforementioned function returns binary result, which you can easily convert to a hex by using bin2hex
, or from a hex to int by using hexdec
.
Examples:
$int = hexdec(bin2hex(openssl_random_pseudo_bytes(1, $strong))); // 1 byte int
$int = hexdec(bin2hex(openssl_random_pseudo_bytes(2, $strong))); // 2 byte int