CPython 3.9 uses CryptGenRandom(), which has been deprecated by Microsoft.

I'm told the randomness produced by CryptGenRandom() is fine, but Microsoft has introduced a newer API for getting randomness.

For these reasons, Python/bootstrap_hash.c should be updated to use https://docs.microsoft.com/en-us/windows/win32/seccng/cng-por , but it is not urgent, and is not needed in older versions of CPython.

Also the documentation that references CryptGenRandom() should be updated, EG: https://docs.python.org/3/library/os.html#os.urandom

Dan, the Microsoft URL in your message gives a 404 for me. Did you perhaps mean to end it with "cng-portal" (instead of "cng-por")?

https://docs.microsoft.com/en-us/windows/win32/seccng/cng-portal ?

Yes, cng-portal.

On Mon, Jul 12, 2021 at 3:24 PM Thomas Grainger <report@bugs.python.org>
wrote:

>
> Thomas Grainger <tagrain@gmail.com> added the comment:
>
> https://docs.microsoft.com/en-us/windows/win32/seccng/cng-portal ?
>
> ----------
> nosy: +graingert
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <https://bugs.python.org/issue44611>
> _______________________________________
>

-- 

Dan Stromberg | Senior Software Engineer

Mobile +1.949.342.6502

<https://keepersecurity.com/>

** This email is confidential and is intended for the recipient(s)
addressed herein **

@tim.peters

Can you please take a look at GH-27168?
I would like to get your review before merging this PR :)

New changeset 906fe47083bc9ab7ed2b70c99c1b0daad021f126 by Dong-hee Na in branch 'main':
bpo-44611: Use BCryptGenRandom instead of CryptGenRandom on Windows (GH-27168)
https://github.com/python/cpython/commit/906fe47083bc9ab7ed2b70c99c1b0daad021f126

New changeset 4463fa2fa111e03f7ec47e6e9d433104aa943605 by Dong-hee Na in branch 'main':
bpo-44611: Update docs for os and whatsnew 3.11 (#27314)
https://github.com/python/cpython/commit/4463fa2fa111e03f7ec47e6e9d433104aa943605

Would it be possible to document in os.urandom() documentation that the BCryptGenRandom() function is used on Windows with the "system-preferred random number generator algorithm"? (I don't think that we should mention the BCRYPT_USE_SYSTEM_PREFERRED_RNG constant.)

Thanks for this change, I like the fact that hCryptProv variable could be removed!