MP_GEN_RANDOM() calling rand() might be insecure

[mkj]

https://github.com/libtom/libtommath/blob/develop/tommath.h#L113
On non-BSD platforms MP_GEN_RANDOM() calls rand(). It's used by mp_rand() which is in turn used by RSA blinding. Is that secure?

It would probably be best for a crypto library should totally avoid calling rand() anywhere - it would be easy for someone to assume mp_rand() has good quality entropy.
It also raises a warning in Coverity.

[sjaeckel]

I'm not 100% sure what to do here... we could provide something like ltc's rng_get_bytes() which could fall back to rand() in the worst case!?

at least we have to get rid of the direct call to rand() and use a library-provided function instead. Like that someone could still replace the call (at link-time) by its own implementation that is hopefully better :)

@libtom/libtomcrypt @libtom/libtommath what do you think?