Terry Reedy wrote:
> On 5/24/2011 12:06 PM, Victor Stinner wrote:
> >Le mardi 24 mai 2011 à 11:27 -0400, Terry Reedy a écrit :
> >>>
> >>>+.. function:: RAND_bytes(num)
> >>>+
> >>>+ Returns *num* cryptographically strong pseudo-random bytes.
> >>>+
> >>>+ .. versionadded:: 3.3
> >>>+
> >>>+.. function:: RAND_pseudo_bytes(num)
> >>>+
> >>>+ Returns (bytes, is_cryptographic): bytes are *num* pseudo-random bytes,
> >>>+ is_cryptographic is True if the bytes generated are cryptographically
> >>>+ strong.
> >>>+
> >>>+ .. versionadded:: 3.3
> >>
> >>I am curious what 'cryptographically strong' means, what the real
> >>difference is between the above two functions, and how these do not
> >>duplicate what is in random.random.
> >
> >An important feature of a CPRNG (cryptographic pseudo-random number
> >generator) is that even if you know all of its output, you cannot
> >rebuild its internal state to guess next (or maybe previous number). The
> >CPRNG can for example hash its output using SHA-1: you will have to
> >"break" the SHA-1 hash (maybe using "salt").
>
> So it is presumably slower. I still do not get RAND_pseudo_bytes,
> which somehow decides internally what to do.
According to the RAND_bytes manual page from OpenSSL:
RAND_bytes() puts num cryptographically strong pseudo-random
bytes into buf. An error occurs if the PRNG has not been seeded
with enough randomness to ensure an unpredictable byte
sequence.
RAND_pseudo_bytes() puts num pseudo-random bytes into buf.
Pseudo-random byte sequences generated by RAND_pseudo_bytes() will
be unique if they are of sufficient length, but are not
necessarily unpredictable. They can be used for non-cryptographic
purposes and for certain purposes in cryptographic protocols, but
usually not for key generation etc.
And:
RAND_bytes() returns 1 on success, 0 otherwise. The error code can
be obtained by ERR_get_error(3). RAND_pseudo_bytes() returns 1 if
the bytes generated are cryptographically strong, 0 otherwise.
Both functions return -1 if they are not supported by the current
RAND method.
So it seems to me that RAND_bytes() either returns cryptographically
strong data or fails (is it possible to detect the failure with the
Python function? Should this be documented?). RAND_pseudo_bytes()
always succeeds but does not necessarily generate cryptographically
strong data.
>
> > Another important feature is that even if you know the internal state,
> >you will not be able to guess all previous and next numbers, because the
> >internal state is regulary updated using an external source of entropy.
> >Use RAND_add() to do that explicitly.
> >
> >We may add a link to Wikipedia:
> >http://en.wikipedia.org/wiki/CPRNG
>
> That would be helpful
> >
> >Read the "Requirements" section, it's maybe more correct than my
> >explanation:
> >http://en.wikipedia.org/wiki/CPRNG#Requirements
> >
> >About the random module, it must not be used to generate passwords or
> >certificates, because it is easy to rebuild the internal state of a
> >Mersenne Twister generator if you know the previous 624 numbers. Since
> >you know the state, it's also easy to generate all next numbers. Seed a
> >Mersenne Twister PRNG doesn't help. See my Hasard project if you would
> >like to learn more about PRNG ;-)
> >
> >We may also add a link from random to SSL.RAND_bytes() and
> >SSL.RAND_pseudo_bytes().
Obviously, the user needs to be familiar with the concept of
"cryptographically strong randomness" to use these functions.
Petri Lehtinen
_______________________________________________
Python-Dev mailing list
Python-Dev@python.org
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe:
http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
