Skip to main content
Information Security

Return to Question

added 64 characters in body
Source Link
MiniQuark
MiniQuark
  • 123
  • 5

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?

Edit: I forgot to mention that my host OS is MacOS 12.6.

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?

Edit: I forgot to mention that my host OS is MacOS 12.6.

Became Hot Network Question
Source Link
MiniQuark
MiniQuark
  • 123
  • 5

Is it safe to use Python's secrets module in a fresh docker container?

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?

My understanding is that the secrets module is based on random.SystemRandom, which in turn relies on os.urandom. Its documentation states:

On Linux, if the getrandom() syscall is available, it is used in blocking mode: block until the system urandom entropy pool is initialized (128 bits of entropy are collected by the kernel). See the PEP 524 for the rationale. On Linux, the getrandom() function can be used to get random bytes in non-blocking mode (using the GRND_NONBLOCK flag) or to poll until the system urandom entropy pool is initialized.

I have no idea how to check whether or not the getrandom() syscall is available. And even if it is, can I trust the entropy pool on a Docker container, since it has less sources of entropy than a regular machine?