Python's pycrypto library for random number generation vs os.urandom

pycrypto, python, random

Solution

In the link you gave, the only reason given to prefer `urandom()` is that it pulled less code in (the OS implements "most of it", and `os.urandom()` is built in to Python).

If you're going to distribute a Python package, you can simplify users' lives by minimizing external dependencies. That's the entire point of the link you found.

In terms of quality, either way should work fine. I prefer `urandom()` because I understand what it does; I never dug into the guts of `PyCrypto`. But `urandom()` has been criticized for use in some environments. Click this and scroll down to the part that starts

Gutterman, Pinkas, & Reinman in March 2006 published a detailed cryptographic analysis of the Linux random number generator ...

Problem

I was trying to understand and figure out if I should use `os.urandom()` or `Crypto.Random.new()` for cryptographically secure pseudo-random numbers. The following website seems to suggest to use `os.urandom()`: https://github.com/mozilla/PyHawk/pull/13 but I don't really see why and the other websites I found online don't really explain which one to use. If anyone knows which one is secure for cryptographic use, I would appreciate the advice! One of the things that specifically worry me is that, I plan to use it to generate random numbers but I am worried that one day I generate some random numbers and the next day the state of the generator is the same and it starts to generate the same "random" numbers.

Original source