note about things still to do with RAND_bytes