I'm not sure if we need this. It's an annoying amount of code because we can't really use the unix/rand.rs implementation (and don't have any remaining file I/O code elsewhere). See comment for details.
That said, this should avoid HashDOS, but I'm unsure if that was plausible anyway without this change. ISTM most of the time we'll still ensure a unique seed due to the per-use increment in RandomState, and I think SipHash is strong enough that per-use unique seeds are sufficient to avoid the issue unless the attacker can (probabilistically) guarantee that they're the first caller of that function. That's unlikely but not so unlikely that it seems ignorable...
I've opted to panic on failure (the way the stdlib does) rather than fall back to insecure behavior, since if there's a benefit to having it, it seems bad to allow it to fail silently.
I'm not sure if we need this. It's an annoying amount of code because we can't really use the
unix/rand.rsimplementation (and don't have any remaining file I/O code elsewhere). See comment for details.That said, this should avoid HashDOS, but I'm unsure if that was plausible anyway without this change. ISTM most of the time we'll still ensure a unique seed due to the per-use increment in RandomState, and I think SipHash is strong enough that per-use unique seeds are sufficient to avoid the issue unless the attacker can (probabilistically) guarantee that they're the first caller of that function. That's unlikely but not so unlikely that it seems ignorable...
I've opted to panic on failure (the way the stdlib does) rather than fall back to insecure behavior, since if there's a benefit to having it, it seems bad to allow it to fail silently.
Any thoughts @workingjubilee?