Don't fall back. If you don't have a reasonable enough environment to get a PRNG, you should halt and complain very loudly.

As for actually generating random numbers, here's a good explanation from 'tptacek: http://sockpuppet.org/blog/2014/02/25/safely-generate-random...