"Not a crypto library" warning is confusing about book HOT 5 OPEN

Cross-posting to the main repo.

This post can stay open: the book probably needs updating eventually.

from book.

While this library has CSPRNGs that are in fact cryptographically secure, this is not a general purpose cryptographic library providing other algorithms like encryption and authentication? (And if you want encryption and authentication you should go to the referenced libraries instead of building your own using rand.)

I think this is accurate, but we cannot guarantee that our implementations are cryptographically secure. It's more of a best-effort thing, we don't spend the resources in verifying our implementations that a crypto library might.

If you look at crypto libraries, they use getrandom directly to generate keys, and you might want to do something similar if cryptographic security is important.

from book.

Was reading the book as I need a secure RNG and this statement confused me. Also the links suggest that the other projects provide a secure RNG. But RustCrypto has no RNG, and Ring only provides an abstraction over the OS RNG.

from book.

Ring only provides an abstraction over the OS RNG.

This is AFAIK best practice for cryptographic use cases: Don't use a user-space CSPRNG, use the OS directly (i.e. getrandom).

from book.

This section of the book was updated (#61) to clarify what the the crate does and doesn't attempt to provide. Nothing fundamental changes. Any comments?

Note that the book is for documentation; for changes to rand itself see my cross post to the main repo.

from book.