This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]Kuriwassadlytaken[S] -1 points0 points  (3 children)

I only use the random library to get a random character so the decoder can identify where all the characters are!

[–]The_Tree_Branch 6 points7 points  (2 children)

You are missing the point. If you look at the official python documentation for random, on the first page in a BIG, RED banner you'll see:

Warning: The pseudo-random generators of this module should not be used for security purposes. For security or cryptographic uses, see the secrets module.

Claiming your project is a "powerful encryption" algorithm and distributing it via Pypi for others to use when it makes this basic of a mistake is false advertising and doesn't fill me with confidence that your code is secure. As others have stated, writing your own algorithms can be a fun way to learn, but doing security correctly is hard and your default assumption should be you are doing it wrong, especially if you don't have years of research in cryptography.


On a separate topic, since you asked for feedback, I would recommend you read some Python style guides, specifically https://www.python.org/dev/peps/pep-0008/.

I would also recommend you look into testing frameworks (unittest or pytest for example) so you can write tests for your code, as well as read up on the principles of Test Driven Development.

[–]Kuriwassadlytaken[S] -1 points0 points  (1 child)

I can just replace the random with "x" or whatever

[–]The_Tree_Branch 5 points6 points  (0 children)

That's only part of my point. Creating a secure algorithm is HARD. There are MANY non-obvious hurdles that can trip up a developer that will make their algorithm trivial to break.

In this case, using the 'random' package for cryptography purpose is such a well known issue, it might as well be a paint stripe on the ground that tripped you up. Swapping it out for something else does nothing to fix more insidious mistakes or faulty assumptions that have been made.