Expand description
Random bytes, read straight from the operating system.
Session ids, CSRF tokens, encryption nonces and application keys all come from here. Unlike a protocol nonce, most of these values are secrets: an attacker who can predict a session id is logged in as somebody else. So the only source we trust is the OS CSPRNG, and a system that cannot provide one gets a loud error rather than a quiet downgrade.