I'm using the SHA-256 algorithm to generate a number in one of my programming projects. A SHA-256 hash is calculated from three strings: one the user can edit, one the user can view but not edit and one the user cannot view or see until it is changed to a new string.
From the hash, the first two characters are looked at to determine the number. Each of the 256 combinations of two letters/numbers that can appear in a sha256 hash are arbitrarily assigned a value with the following pattern.
aa=1, ab=2, ac=3...fd=84, fe=85, ff=86...97=254, 98=255, 99=256: In the project a number from 1-100 is needed so all of the combinations of two characters are looked at from left to right until a number in that range is found.
After testing this by generating thousands of hashes from seemingly random inputs (with php I made the input
md5(uniqid(rand()))) multiple times, the average number from 1-100 was around 51.
Any idea what is causing the number to be weighted more towards combinations from "dc" to "0d" (51-100) compared to "aa" to "da" (1-49)? Is this a flawed way to determine a random number even if the input is random? What if the player has control over one of the strings added to the input like described in the first paragraph?
Note: I don't study cryptography so explanations without intense cryptography jargon would be the most useful!