Improve the default seeding in random module to use 32 bytes of entropy when available.

2 files changed, 5 insertions, 1 deletions

diff --git a/Lib/random.py b/Lib/random.py
index 1a3a13e..2f2f091 100644
--- a/Lib/random.py
+++ b/Lib/random.py
@@ -108,7 +108,7 @@ class Random(_random.Random):
 
         if a is None:
             try:
-                a = long(_hexlify(_urandom(16)), 16)
+                a = long(_hexlify(_urandom(32)), 16)
             except NotImplementedError:
                 import time
                 a = long(time.time() * 256) # use fractional seconds
diff --git a/Misc/NEWS b/Misc/NEWS
index 635c33b..e974ee4 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -44,6 +44,10 @@ Library
   as documented.  The pattern and source keyword parameters are left as
   deprecated aliases.
 
+- Improve the random module's default seeding to use 256 bits of entropy
+  from os.urandom().  This was already done for Python 3, mildly improving
+  security with a bigger seed space.
+
 - Issue #15618: Make turtle.py compatible with 'from __future__ import
   unicode_literals'.  Initial patch by Juancarlo Añez.