From bb7626b2f257852f426723de551418753e3dd692 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Wed, 9 Oct 2019 15:03:45 -0400 Subject: Use secrets and fall back to random.SystemRandom for keys The random module uses the Mersenne Twister pseudorandom number generator and is not a cryptographically secure random number generator[0]. The secrets[1] module is intended for generating cryptographically strong random numbers, so recommend using that to generate the secret key. It's new in Python 3, so if it's unavailable fall back to using the ``os.urandom()`` backed implementation of random. NOTE(stephenfin): Modified to include change to 'config.yaml'. Also renamed reno to just stick with hyphens for filenames. [0] https://docs.python.org/3/library/random.html [1] https://docs.python.org/3/library/secrets.html Signed-off-by: Jeremy Cline Signed-off-by: Stephen Finucane --- docs/deployment/installation.rst | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'docs') diff --git a/docs/deployment/installation.rst b/docs/deployment/installation.rst index d422573..f477a11 100644 --- a/docs/deployment/installation.rst +++ b/docs/deployment/installation.rst @@ -254,9 +254,15 @@ This should be a random value and kept secret. You can generate and a value for .. code-block:: python - import string, random + import string + try: + import secrets + except ImportError: # Python < 3.6 + import random + secrets = random.SystemRandom() + chars = string.ascii_letters + string.digits + string.punctuation - print(repr("".join([random.choice(chars) for i in range(0,50)]))) + print("".join([secrets.choice(chars) for i in range(50)])) Once again, store this in ``production.py``. -- cgit v1.2.3