No, sorry, your generator is awfully bad. You seed it with values which do not have much entropy (the PID fits on 16 bits...) or are highly guessable (the "current time" is not exactly a secret value, everybody can know it with remarkable accuracy). And the generator hiding under
rand() is known to be breakable (it depends on the actual operating system, but many system use a linear congruential generator which can easily be inverted).
You will get something which vaguely looks randomish at first sight, but will not resist successfully attempts at cracking it, i.e. predicting future output of the generator. Resisting cracking attempts from smart attackers is all what security is about. Your generator might be appropriate for some non-security-related usages, though (although
rand() is known to be quite bad at those too).
For correct random number generation, you need:
- an initial seed with enough entropy;
- a cryptographically secure PRNG which will expand that seed into a long stream of bytes which will be indistinguishable from randomness (even in the eyes of a smart, powerful individual with big computers who is intent on predicting the next random byte).
The initial seed must come from some hardware events ("physical" randomness), because software is, down to the transistor level, deterministic. The operating system is in ideal position to gather physical events (that's its job, after all). Therefore, use the OS. This means:
- On Unix-like systems (like Linux, FreeBSD, Solaris, MacOS X...), use
/dev/random; see this answer for details).
- On Windows (Win32), call
- On Java, use
- On .NET, use