Is this secure?

[mk]

On 2010-02-24 18:56, Michael Rudolf wrote:

> The reason is 256 % 26 != 0
> 256 mod 26 equals 22, thus your code is hitting a-v about 10% (256/26 is
> approx. 10) more often than w-z.

<Barbie voice>writing secure code is hard...

I'm going to switch to PHP: Python world wouldn't lose much, but PHP 
would gain a lot.

> You might want to skip the values 0-22
> to achieve a truly uniform distribution.

Hmm perhaps you meant to skip values over 256 - 22 ? Bc I'm getting this 
(reduced the run to 1000 generated strings):

def gen_rand_word(n):
     with open('/dev/urandom') as f:
         return ''.join([chr(ord('a') + ord(x) % 26) for x in f.read(n) 
if ord(x) > 22])


z 3609
b 3608
s 3567
e 3559
j 3556
r 3555
g 3548
p 3540
m 3538
q 3532
h 3528
y 3526
v 3524
i 3500
x 3496
c 3488
k 3488
l 3487
u 3487
a 3469
o 3465
d 3455
t 3439
f 3437
n 3417
w 3175

While with this:

def gen_rand_word(n):
     with open('/dev/urandom') as f:
         return ''.join([chr(ord('a') + ord(x) % 26) for x in f.read(n) 
if ord(x) < 235])

a 3852
w 3630
s 3623
v 3582
y 3569
p 3568
c 3558
k 3558
b 3556
r 3553
x 3546
m 3534
n 3522
o 3515
h 3510
d 3505
u 3487
t 3486
i 3482
f 3477
e 3474
g 3460
q 3453
l 3437
z 3386
j 3382

1. I'm systematically getting 'a' outlier: have no idea why for now.

2. This is somewhat better (except 'a') but still not uniform.


> FYI: Electronic Cash PINs in europe (dont know about the rest of the
> world) were computed the same way (random hexdigit and just mod it when
> it's too large) leading to a high probability that your first digit was
> a 1 :)

Schadenfreude is deriving joy from others' misfortunes; what is the 
German word, if any, for deriving solace from others' misfortunes? ;-)

Regards,
mk