[$] Python's two modules for random numbers (lwn.net)
Python's <a
href="https://docs.python.org/3/library/random.html"><tt>random</tt></a>
and <a
href="https://docs.python.org/3/library/secrets.html"><tt>secrets</tt></a>
modules both include utilities for obtaining random values, but only one of them is suitable for generating passwords and security tokens.
For much of Python's history, <tt>random</tt> was used for passwords and tokens anyway, despite documentation that called it unsuitable for cryptography.
In 2015, Python's core team debated whether to fix that misuse by making <tt>random</tt> secure by default.
Instead, in 2016, Python 3.6 added a second module: <tt>secrets</tt>. The
<tt>random</tt> module is still misused at times, so it is instructive
to look into how the random-number modules should be used.
href="https://docs.python.org/3/library/random.html"><tt>random</tt></a>
and <a
href="https://docs.python.org/3/library/secrets.html"><tt>secrets</tt></a>
modules both include utilities for obtaining random values, but only one of them is suitable for generating passwords and security tokens.
For much of Python's history, <tt>random</tt> was used for passwords and tokens anyway, despite documentation that called it unsuitable for cryptography.
In 2015, Python's core team debated whether to fix that misuse by making <tt>random</tt> secure by default.
Instead, in 2016, Python 3.6 added a second module: <tt>secrets</tt>. The
<tt>random</tt> module is still misused at times, so it is instructive
to look into how the random-number modules should be used.
Comments