python-ev.png

Python 3.6, the newest major release of the Python language, has added a new module, called secrets, to help generate cryptographically strong random numbers for managing secrets, like account authentication, tokens and related secrets. Python developers are highly likely to prefer secrets over the default pseudo-random number generator in the random module, since it’s not meant for cryptography or security, but modelling and simulation.

Let’s understand with an example how one can create their own cryptographically strong pseudo-random values and generate tokens using the secrets module.

How to create Cryptographically Strong Pseudo-Random Values using secrets

>>> import secrets
>>> import string
>>> characters = string.ascii_letters + string.digits
>>> secure_password = ''.join(secrets.choice(chNo Records.aracters) for i in range(10))
>>> secure_password
'SRvM54ZAs1'

The first step is to import the secrets and the string modules. Then we create a string of uppercase letters and integers. Now, in order to choose characters randomly to generate a secure password, we need to use the secrets module’s choice() method. The reason it’s being called a secure password is because there’s been a use of mixed case, numbers and symbols in the password, which is highly advised to people to keep their passwords protected from hack attacks.

How to Generate Tokens using secrets

There is not one but several methods to generate tokens using the secrets module. Below are mentioned some examples to ease your learning on token generation using secrets.

>>>: secrets.token_bytes()
b'\xd1Od\xe0\xe4\xf8Rn\xf4G\xdb\x08\xa8\x85\xeb\xba>\x8cO\xa7XV\x1cb\xd6\x11\xa0\xcaK'
>>> secrets.token_bytes(8)
b'\xfc,9y\xbe]\x0e\xfb'
>>> secrets.token_hex(16)
'6cf3baf51c12ebfcbe26d08b6bbe1ac0'
>>> secrets.token_urlsafe(16)
'5t_jLGlV8yp2Q5tolvBesQ'

The token_bytes function here allows to return a random byte string containing nbytes number of bytes. A reasonable default could also be put into use when nbytes is None or not supplied. In the first example, there is no mention of number of bytes, hence Python itself choose a reasonable number there. The token-bytes function was used again, but this time with 8 bytes. The next function used was token_hex, to return a random text string, in hexadecimal. The token_urlsafe function is the last one used there, meant to return a random URL-safe text string. Base64 encoding was also used for text.

Click here to unveil 7 Python libraries to use in 2017

How Many Bytes to Use for Tokens?

You should have sufficient randomness for your tokens to secure them against brute-force attacks. It’s advised that at least 32 bytes (256 bits) of randomness should be used to protect tokens from security breaches.

The Python developer community will see the secrets module as an important addition to Python 3.6. With secrets, Python 3.6 developers now have a reliable way to generate cryptographically strong tokens and passwords.

What’s your view on addition of secrets to Python 3.6? Would you like to give the secrets module a try for generating tokens and passwords? Please share your views in the comment box below.

Source 1: http://www.blog.pythonlibrary.org/

Source 2: https://docs.python.orgÂÂ