Is this secure?

[Michael Rudolf]

Am 24.02.2010 18:23, schrieb mk:
> Even then I'm not getting completely uniform distribution for some reason:
> d 39411
> l 39376
> f 39288
> a 39275
> s 39225
> r 39172
> p 39159
> t 39073
> k 39071
> u 39064
> e 39005
> o 39005
> n 38995
> j 38993
> h 38975
> q 38958
> c 38938
> b 38906
> g 38894
> i 38847
> m 38819
> v 38712
> z 35321
> y 35228
> w 35189
> x 35075
>
> Code:
>
> import operator
>
> def gen_rand_word(n):
> with open('/dev/urandom') as f:
> return ''.join([chr(ord('a') + ord(x) % 26) for x in f.read(n)])

The reason is 256 % 26 != 0
256 mod 26 equals 22, thus your code is hitting a-v about 10% (256/26 is 
approx. 10) more often than w-z. You might want to skip the values 0-22 
to achieve a truly uniform distribution.

FYI: Electronic Cash PINs in europe (dont know about the rest of the 
world) were computed the same way (random hexdigit and just mod it when 
it's too large) leading to a high probability that your first digit was 
a 1 :)

Regards,
Michael