random is not secrets

Level: 201 · working knowledge

Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The bullets below are the questions the finished page has to answer.

One line: Two random number generators in one standard library, and only one of them may ever produce a key.

The questions this page has to answer

• What does a PRNG guarantee, and what does it explicitly not?
• Given a handful of outputs, what can an observer compute about the rest of the stream?
• Why is random.seed(time.time()) a two-line key recovery?
• What is a CSPRNG doing differently, and where does the operating system get its entropy?
• /dev/random vs /dev/urandom, and why the old advice about blocking is wrong on a modern kernel.

See also

• 03_Randomness — the chapter this belongs to
• ROADMAP.md — where this sits in the queue