The default PRNG function may be broken.

[matthewmummert5]

According to the PHP website, using rand() is not cryptographically secure.
http://php.net/manual/en/function.rand.php

This is because the rand() function is designed as a uniform distribution random function. I recommend you use a Gaussian distribution random function instead. Consult Bruce Schneier for safe parameters for the mean, and standard deviation of your Gaussian function.