Generating a salt in PHP

Question

What's the best way to generate a cryptographically secure 32 bytes salt in PHP, without depending on libraries seldom included in typical PHP installations?

After some googling I discovered that mt_rand is not considered secure enough, but I haven't found a suggestion for a replacement. One article suggested reading from /dev/random but not only this won't work on windows; it is also very slow.

I want a reasonable balance between security and speed (ie, it shouldn't take 20 seconds to generate 512 bytes, like /dev/random usually does)

Answer 1

i think microtime() is secure enough

Answer 2

You might want to take a look at the documentation (and comments) for mcrypt_create_iv().

Answer 3

uniqid() should be fine for this purpose.