mt_rand() is not secure from a security point of view and predictable. Let's use openssl_random_pseudo_bytes() instead.

Before: 26 bits entropy
After: 72 bits entropy