New submission from John Beck: A recent Solaris build upgrade resulted in a massive slowdown of a package operation (our package client is written in Python). Some DTrace revealed this was because os.urandom() calls had slowed down by a factor of over 300. This turned out to be caused by an upgrade of Python from 2.7.9 to 2.7.10 which included:
- Issue #22585: On OpenBSD 5.6 and newer, os.urandom() now calls getentropy(), instead of reading /dev/urandom, to get pseudo-random bytes. By adding ac_cv_func_getentropy=no to our configure options, we were able to get back the performance we had lost. But our security experts warned: --- OpenBSD only has getentropy(2) and we are compatible with that. Linux has both getentropy(2) and getrandom(2) Solaris has getentropy(2) and getrandom(2). The bug is in Python it should not use getentropy(2) for the implementation of os.urandom() unless it builds its own DRBG (Deterministic Random Bit Generator) around that - which will mean it is "caching" and thus only calling getentropy() for seeding very infrequently. You can not substitute getentropy() for getrandom(), if you need randomness then entropy does not suffice. They are using getentropy(2) correctly in the implementation of _PyRandom_Init(). I would personally recommend that the upstream adds os.getentropy() changes os.urandom() to use getrandom(buf, sz, GRND_NONBLOCK) and os.random() to use getrandom(buf, sz, GRND_RANDOM). As it is the upstream implementation is arguably a security vulnerability since you can not use entropy where you need randomness. --- where by "upstream" he meant "python.org". So I am filing this bug to request those changes. I can probably prototype this in the reasonable near future, but I wanted to get the bug filed sooner rather than later. ---------- components: Interpreter Core messages: 249837 nosy: jbeck priority: normal severity: normal status: open title: os.urandom() should call getrandom(2) not getentropy(2) versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6 _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue25003> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
