> Don't forget that it should ideally be cryptographically random.

I thought that went without saying, nut yes, it must be cryptographically random (not ideally—it must be).