[eru]

You are a wasting a lot of random bits this way, don't you?

[adtac]

Not if you already have 2^n bits at hand. In fact, if you have 2^n bits of entropy, popcount is probably more efficient than generating n more bits randomly.

[JoachimSchipper]

Sure, but generating random bits is fast with e.g. AES-NI, RdRand or a software implementation of e.g. ChaCha.