random() is an insecure random number generation function

[wsp1991]

random() is an insecure random number generation function，Is there a safer solution,such as /dev/random

generate_pw_salt (char salt[], const unsigned int salt_size)
{
struct timeval tv;
char *rand_str;
int remain = salt_size;

salt[0] = '\0';

(void) gettimeofday (&tv, NULL);
srandom (tv.tv_sec ^ tv.tv_usec ^ getpid ());

do {
	rand_str = l64a (random());
	strncat (salt, rand_str, remain);
	remain = remain - strlen(rand_str);
} while (remain > 0);

salt[salt_size] = '\0';

}

[lcp]

Thanks for the reviewing. Indeed, the quality of random numbers generated by random() is not as good as /dev/random. I'll evaluate converting random() to getrandom() which draws random bytes from /dev/random or /dev/urandom.

[lcp]

I'm working on the patch to replace generate_pw_salt() with crypt_gensalt() and this should fix #44 all together.