CODEWITHSUNDEEP
python-3.xsecurityrandom
PyWebDesign
PyWebDesign

Reputation: 197

is Python's 3 random.random good enough for security if seeded with high entropy seeds before every use?

Is Python's 3 random.random() good enough for security if seeded with high entropy seeds before every use? How to know and verify beyond verifying the distribution shape.

So the question is about using random.random to transform some entropy source to many choices inside of an item of an array.

Let say for example we have a dictionary of 9k words and want 18 words chosen at random. We do not want anyone else to ever be able to find them by playing around with pythons' random.random().

dic = ["word1", "word2", ... , "word19k"]
while(true):
  seed = os.urandom(50)
  random.seed(seed)
  print(random.choice(dic))

Upvotes: 3

Views: 3326

Answers (2)

PyWebDesign
PyWebDesign

Reputation: 197

Ok so after asking elsewhere, if the random generator produce a uniform distribution, the whole operation is useless but does not introduce security risks.

as in the question, if the random generator is seeded with new seed for every generation. It is like applying a simple useless transformation x => f(x).

The response to this question is very simple if you use high entropy and pass it through python random.random ou random.choice, it is as secure as the seed quality. I would not recommend changing this as a high priority change to a running system.

The other part of the response is: don't do that, it is useless. Use a better way to secure pick instead of random.choice.

Upvotes: 2

L_Church
L_Church

Reputation: 713

Python documentation of random specifies:

Warning The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator.

As stated in the comments of the question, the better and more secure way of generating random numbers (for cryptography purposes) is os.urandom().

Example code from the linked question

>>> import os
>>> os.urandom(10)
'm\xd4\x94\x00x7\xbe\x04\xa2R'
>>> type(os.urandom(10))
<type 'str'>
>>> map(ord, os.urandom(10))
[65, 120, 218, 135, 66, 134, 141, 140, 178, 25]

Upvotes: 4

Related Questions