It's Dangerous, a Python cryptographic signing module

Re:It's Dangerous, a Python cryptographic signing module by the_mitsuhiko on Sunday June 10, 2012 @11:20AM (#4091265)

> but it's a per-app password, so you can just do run bcrypt once, at startup.

itsdangerous has nothing to do with passwords. It's about signing small messages and these messages are obviously created at runtime.

> nonsense and just use a really strong secret key

That's how you should use itsdangerous: use a strong secret key.

[ Parent | on HN ]

Re:It's Dangerous, a Python cryptographic signing module by Luit on Sunday June 10, 2012 @11:42AM (#4091331)

One way to get a good strong secret key for this purpose:

$ python

>>> import os

>>> os.urandom(64)

[ Parent | on HN ]

Re:It's Dangerous, a Python cryptographic signing module by tcas on Sunday June 10, 2012 @09:26PM (#4092830)

You shouldn't use urandom for crypto purposes. /dev/random is generated (on most platforms) as cryptographic strength numbers (usually from hardware), but can block if it runs out of data. /dev/urandom was created with the guarantee to never block and will use /dev/random's pool of numbers initially but can start outputting lower entropy numbers if /dev/random blocks.

[ Parent | on HN ]

Re:It's Dangerous, a Python cryptographic signing module by amalcon on Sunday June 10, 2012 @08:25PM (#4092714)

/dev/random is better than urandom for this sort of thing. On linux:

dd if=/dev/random bs=64 count=1 2>/dev/null | hexdump

[ Parent | on HN ]