On Fri, Jul 9, 2021 at 2:26 PM Tim Peters <tim.pet...@gmail.com> wrote:
> [Ethan Furman] > > A question [1] has arisen about the viability of `random.SystemRandom` in > > Pythons before and after the secrets module was introduced > > (3.5 I think) -- specifically > > > > does it give independent and uniform discrete distribution for > > cryptographic purposes across CPython 3.x versions? > > > > ,,, > > [1] https://stackoverflow.com/q/68319071/208880 > > `secrets` is just a wrapper around `random.SystemRandom`, so the > presence or absence of `secrets` doesn't matter. > > As to SystemRandom, all answers depend on the quality of the platform > os.urandom(), which Python has no control over. See my answer here, > and the comments on it: > > > https://stackoverflow.com/questions/20936993/how-can-i-create-a-random-number-that-is-cryptographically-secure-in-python/20937265#20937265 > It looks like CPython could do better on Windows: SystemRandom (because of os.urandom()) is good on Linux and mac, but on Windows they use the CryptGenRandom deprecated API.... Supporting detail: https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptgenrandom Should I open an issue?
_______________________________________________ Python-Dev mailing list -- python-dev@python.org To unsubscribe send an email to python-dev-le...@python.org https://mail.python.org/mailman3/lists/python-dev.python.org/ Message archived at https://mail.python.org/archives/list/python-dev@python.org/message/QP4EFVS66JMNXRADYKPW4YOI4PDCD6OU/ Code of Conduct: http://python.org/psf/codeofconduct/
