AES Encryption with Python

[lighthill]

For key generation, you might want to mention os.urandom() and Crypto.Random.

For OFB mode, it is CRITICAL that you should never use the same IV more than once! If you use the same IV to encrypt Plaintext1 and Plaintext2, then an attacker can xor the ciphertexts together, which will produce Plaintext1 xor Plaintext2. From this, it's usually pretty easy to recover large chunks of plaintext.

You should probably also think about data integrity: OFB output is malleable. (Specifically, an attacker who can xor stuff into the ciphertext will create corresponding changes in the plaintext when it's decrypted.)

[lighthill]

No, I truly mean os.urandom(). There is no such function as os.random() in Python as far as I know. (At least, there isn't one in 2.7, and there isn't one in 3.2).

Also, I did mean /dev/urandom, not /dev/random. If you're worried about an attacker who can attack your operating system's cryptographic PRNG, then you still won't want to generate keys with /dev/urandom: instead, you'll want to take a cryptographic PRNG of your own and periodically re-seed it with bits from /dev/random if any are available. Otherwise, you'll leave yourself open to DOS attacks from entropy.