pyca/cryptography — pull request #377 by reaperhulk (2013-12-30 14:43:21+00:00)
Title: [WIP] Set default RAND engine to urandom/cryptgenrandom

This is a proposed solution to our concerns about ```fork()``` with regard to the userland CSPRNG OpenSSL uses (currently blocking #292). It adds a new engine named "urandom_engine" and sets it as the default RAND source when you instantiate a backend object. ```unregister_urandom_engine``` sets it back to the OpenSSL default CSPRNG while ```register_urandom_engine``` reactivates it. These methods exist for users who wish to explicitly opt out of the urandom/cryptgenrandom option.

- [x] *nix support
- [x] win32 support (via CryptGenRandom)
- [x] register/unregister
- [ ] documentation

A few notes: On linux/OS X urandom is ~33% slower than the OpenSSL CSPRNG. It is currently unknown whether this is problematic. Additionally, we should try to run this approach past a cryptographer and get their reactions before landing (if we decide we want this).