You're right. Calling RtlGenRandom() directly is probably the best option. I forgot that rand_s() calls RtlGenRandom(), not CryptGenRandom(). Plus both Firefox

You're right. Calling RtlGenRandom() directly is probably the best option. I forgot that rand_s() calls RtlGenRandom(), not CryptGenRandom(). Plus both Firefox and Chrome ran into rare crashes when some bad third-party software (antivirus or malware) injects advapi32.dll hooks, causing rand_s() to crash when it tries to load advapi32.dll in order to call RtlGenRandom(). Firefox bugs: https://bugzil.la/1240589 https://bugzil.la/1240589, https://bugzil.la/1167248 https://bugzil.la/1167248, https://bugzil.la/694344 https://bugzil.la/694344 Chrome bug: https://crbug.com/348400 https://crbug.com/348400