Collected research
Random Number Security in Python
A study of Python's pseudorandom generators for web applications. Because a Python web process imports random once and keeps the Mersenne Twister state alive across requests, an attacker who can read random.random() output from a page such as Plone's error logger can recover state elements with a chosen sequence of requests and cut the entropy of a later token to about 256 options.
Record
- Published by
- blog.ptsecurity.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of blog.ptsecurity.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .