I've seen discussions about bias in dice rolls or coin flips. For instance:
Scientists Destroy Illusion That Coin Toss Flips Are 50–50, showing the coin "
landed with the same side facing upward as before the toss 50.8 percent of the time". The article also shows ways to avoid this, but this small bias isn't something I'd worry about. No attacker is going to find out how you flipped a coin, and brute-force the entire 128 flips.
You can achieve fair results even from slightly biased coins (or unknowingly biased tossing habits):
- Toss the coin twice.
- If the results match, start over, forgetting both results.
- If the results differ, use the first result, forgetting the second.
If you're very paranoid (or simply want to mask off any potential bias), you can XOR your "random sequence" of coin tosses with another supposedly "random sequence" that is produced by another method, like a CSPRNG or a HWRNG or rolling dice.