This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author ncoghlan
Recipients IvanAnishchuk, ncoghlan, steven.daprano, vstinner
Date 2017-03-11.13:07:49
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1489237670.73.0.285991149548.issue29790@psf.upfronthosting.co.za>
In-reply-to
Content
This RFE is unfortunately based on some incorrect assumptions about the way Linux kernels use CSPRNGs and entropy pools. Using /dev/random isn't magically more secure than /dev/urandom, it just makes your applications less reliable for no good reason.

Folks are free to do that through an extension module if they really wish to do so, but it's not an option we're interested in supporting in the standard library.

This is a good article providing some additional background on that topic: http://www.2uo.de/myths-about-urandom/

There was one genuine problem with /dev/urandom (it could return potentially predictable values if the entropy pool hadn't been adequately seeded), but Victor addressed that in PEP 524 by switching to the blocking variant of the getrandom() syscall (when available) rather than using the file descriptor interface.
History
Date User Action Args
2017-03-11 13:07:50ncoghlansetrecipients: + ncoghlan, vstinner, steven.daprano, IvanAnishchuk
2017-03-11 13:07:50ncoghlansetmessageid: <1489237670.73.0.285991149548.issue29790@psf.upfronthosting.co.za>
2017-03-11 13:07:50ncoghlanlinkissue29790 messages
2017-03-11 13:07:49ncoghlancreate