Add randbytes() method to random.Random

[vstinner]

BPO	40286
Nosy	@tim-one, @rhettinger, @mdickinson, @vstinner, @serhiy-storchaka, @vedgar
PRs	bpo-40286: Add randbytes() method to random.Random #19527 bpo-40286: Makes simpler the relation between randbytes() and getrandbits() #19574 bpo-40286: Use random.randbytes() in tests #19575 bpo-40286: Remove C implementation of Random.randbytes() #19797 bpo-40286: Put methods in correct sections. Add security notice #19870
Files	run_random.py: Custom PRNG where randbytes() doesn't fit

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-04-29.16:51:01.179>
created_at = <Date 2020-04-14.22:30:18.004>
labels = ['library', '3.9']
title = 'Add randbytes() method to random.Random'
updated_at = <Date 2020-05-05.05:52:17.085>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2020-05-05.05:52:17.085>
actor = 'rhettinger'
assignee = 'none'
closed = True
closed_date = <Date 2020-04-29.16:51:01.179>
closer = 'vstinner'
components = ['Library (Lib)']
creation = <Date 2020-04-14.22:30:18.004>
creator = 'vstinner'
dependencies = []
files = ['49078']
hgrepos = []
issue_num = 40286
keywords = ['patch']
message_count = 25.0
messages = ['366454', '366457', '366496', '366498', '366500', '366502', '366505', '366507', '366512', '366514', '366524', '366665', '366666', '366676', '366677', '366860', '366861', '366869', '366894', '366911', '366919', '367180', '367676', '367677', '368104']
nosy_count = 6.0
nosy_names = ['tim.peters', 'rhettinger', 'mark.dickinson', 'vstinner', 'serhiy.storchaka', 'veky']
pr_nums = ['19527', '19574', '19575', '19797', '19870']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue40286'
versions = ['Python 3.9']

[vstinner]

The random module lacks a getrandbytes() method which leads developers to be creative how to generate bytes:
https://stackoverflow.com/questions/5495492/random-byte-string-in-python

It's a common use request:

• bpo-13396 in 2011
• bpo-27096 in 2016
• https://bugs.python.org/issue40282#msg366444 in 2020

Python already has three functions to generate random bytes:

• os.getrandom(): specific to Linux, not portable
• os.urandom()
• secrets.token_bytes()

These 3 functions are based on system entropy and they block on Linux until the kernel collected enough entropy: PEP-524.

While many users are fine with these functions, there are also use cases for simulation where the security doesn't matter, and it's more about being able to get reproducible experience from a seed. That's what random.Random is about.

The numpy module provides numpy.random.bytes(length) function for such use case:
https://docs.scipy.org/doc/numpy-1.15.0/reference/generated/numpy.random.bytes.html

One example can be to generate UUID4 with the ability to reproduce the random UUID from a seed for testing purpose, or to get reproducible behavior.

Attached PR implements the getrandbytes() method.

[rhettinger]

If we have to have this, the method name should be differentiated from getrandbits() because the latter returns an integer. I suggest just random.bytes(n), the same as numpy.

Python already has three functions to generate random bytes:

Now, there will be four ;-)

[vedgar]

I suggest just random.bytes(n), the same as numpy.

The problem with this is that people who from random import * (some schools insist on this, probably because most functions they need already start with rand) will shadow builtin bytes. Not that those schools do anything with bytes, but still, it might be inconvenient.

(The metaproblem is of course that some functions already do the "poor man's namespacing" in C-style by starting with rand, and some don't. I'm always for user control of namespacing, but I'm just saying that it doesn't correspond to how many beginners use random module.)

[rhettinger]

Do you have another name suggestion that doesn't have a parallelism problem with the existing name? The names getrandbytes() and getrandbits() suggest a parallelism that is incorrect.

[vedgar]

I think that the "module owner";-P must decide whether the random module should follow the C-namespacing or not. Of course, I'm in the "not" camp, so I believe those two "rand..." functions (randrange is completely redundant with random.choice(range)) should be supplemented with random.int and random.float. And then random.bytes will be completely natural. And people might be gently nudged into the right direction when using Python module namespaces.

[rhettinger]

I concur that bytes() isn't a good name, but am still concerned that the proposed name is a bad API decision.

[serhiy-storchaka]

Maybe randbytes()?

[vstinner]

I like "from random import randbytes" name. I concur that "from random import bytes" overrides bytes() builtin type and so can likely cause troubles.

[vstinner]

I updated my PR to rename the method to randbytes().