Python中是否存在可种子化的CSPRNG（密码安全伪随机数生成器）？

Great question—this is a common point of confusion when working with secure randomness, so let's unpack it step by step.

First: Yes, Seeded CSPRNGs Exist #

The random.SystemRandom you tried doesn't respect seeds because it's a wrapper around your system's native CSPRNG (like /dev/urandom on Linux or CryptGenRandom on Windows). These system-level generators are designed to pull entropy from unpredictable system sources (mouse movement, disk activity, etc.) and produce non-deterministic output by default—so setting a seed does nothing here, which is intentional for their core use case of unguessable randomness.

But there are CSPRNG implementations that do support deterministic, seed-based output—they're built using cryptographic algorithms (like AES-CTR or ChaCha20) that are designed to be secure, even when starting from a fixed seed. For example, in Python, you can implement one using the cryptography library:

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend

def create_seeded_csprng(seed):
    # Use AES-CTR mode as a CSPRNG: the seed acts as the AES key
    # Note: For real use, derive a proper key from the seed using a KDF like PBKDF2HMAC if your seed isn't 16/24/32 bytes
    iv = b'\x00' * 16  # For deterministic output, use a fixed IV (only safe if each seed is unique!)
    cipher = Cipher(algorithms.AES(seed), modes.CTR(iv), backend=default_backend())
    return cipher.encryptor()

# Example usage with a fixed, high-entropy seed
secure_seed = b'my_very_secret_16byte_seed'  # 16 bytes for AES-128
prng = create_seeded_csprng(secure_seed)

# Generate a predictable (but secure) "random" integer between 1-100
random_byte_block = prng.update(b'')
rand_int = int.from_bytes(random_byte_block[:2], byteorder='big') % 100 + 1
print(rand_int)  # Will output the same value every time with this seed

Does Seeded CSPRNG Violate Security Requirements? #

Only if you misuse the seed. The core security of these generators depends entirely on two factors:

• Seed entropy: The seed must be a high-entropy value (not something trivial like 1 or a short password). If an attacker can guess or brute-force your seed, they can replicate all your "random" output.
• Seed confidentiality: The seed must stay secret. If it leaks, anyone can generate the exact same sequence of random numbers, which defeats the purpose of using a CSPRNG.

When used correctly (with a secret, high-entropy seed), a seeded CSPRNG is just as secure as a non-seeded system CSPRNG. These are useful for scenarios where you need deterministic but secure randomness—like testing cryptographic protocols, generating reproducible secure keys for testing, or creating consistent randomness across distributed systems with a shared secret seed.

Key Difference from random Module #

Don't confuse seeded CSPRNGs with the standard random module. The random module uses non-cryptographic algorithms (like Mersenne Twister) that are fast but not secure—even with a secret seed, an attacker can predict future output from just a few samples. Seeded CSPRNGs use algorithms proven to resist such attacks, as long as the seed is kept safe.

内容的提问来源于stack exchange，提问作者Have a nice day