Using /dev/random
is meant to be reserved for things which truly need to be cryptographically secure, such as private key material, because it relies on an entropy pool which can be depleted rapidly if the RNG is overused.
Unless for some reason you think the NSA might want to influence the results of your card games?
So /dev/urandom
, a PRNG which never blocks, may be sufficient.
Note well, however, that many serious online card games, especially those which allow gambling, use external physical hardware random number generators for this purpose. In some jurisdictions, using such a device for your online card game is required by law.
As for security, I would expect someone who broke into the server to not bother messing with the RNG and just take your money, or sabotage your application so that he always wins.
/dev/random
sounds like a bad choice for this. Isn't/dev/urandom
or another PRNG implementation sufficient?