I work on some crypto stuff.
I am aware of the following things (source = wikipedia):
Just more comfortable to use the same stuff that Thomas sujested:
private function genIv()
{
$efforts = 0;
$maxEfforts = 50;
$wasItSecure = false;
do
{
$efforts+=1;
$iv = openssl_random_pseudo_bytes(16, $wasItSecure);
if($efforts == $maxEfforts){
throw new Exception('Unable to genereate secure iv.');
break;
}
} while (!$wasItSecure);
return $iv;
}