[Python-ideas] PEP 506 (secrets module) and token functions

[Chris Angelico]

On Sat, Sep 26, 2015 at 11:07 PM, Steven D'Aprano <steve at pearwood.info> wrote:
> Question one:
>
> - token_bytes obviously should return bytes. What should the others
>   return, bytes or str?

str. The point of encoding them is to turn the entropy into some form
of text, so IMO it makes sense to treat this as text.

> Question two:
>
> - Many people will have no idea how many bytes should be used to be
>   confident that it will be hard for an attacker to guess. Earlier, I
>   suggested that the three functions include default values for nbytes,
>   and there were no objections. Do we have consensus on this, and if so,
>   what default value should we use?
>
> Question three:
>
> - If we have default values, do we need some sort of documented
>   exception to the general backwards-compatibility requirement?
>
> E.g. suppose we release the module in 3.6.0 with defaults of 32 bytes,
> and in 3.6.2 we discover that's too small and we should have used 64
> bytes. Can we change the default in 3.6.3 without notice?

So as I understand you, there are three options:

1) No default. Whenever you want entropy, you say how much. Simple.

2) Fixed default, covered by backward guarantee promises.

3) Variable default with an implication that using the default entropy
is "secure enough" for most purposes.

Can you adequately define "secure enough" across all purposes? If so,
I would support that. The precise number would never be documented
specifically (if you want to know what your version does, try it
interactively), and then it can indeed be changed in 3.6.3 - or even
without a version number bump at all (in ten years' time, Red Hat
might choose to continue shipping CPython 3.6.1, but change the
default entropy value).

Otherwise, I would be inclined toward not having a default at all.
Having one that can be changed only in 3.7 seems like the worst of
both worlds - programs can't depend on the value being constant, but a
security enhancement can't be done on an already-released version.

ChrisA