DRBG: make locking api truly private