Should rndstr() use SystemRandom instead of random?

[bjmc]

The rndstr() function is used in various places to generate nonces, session ids, etc. Internally, it relies on the Python random module that uses a deterministic pseudorandom number generator.

The documentation for random includes a vague but stern warning:

Warning The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator.

Would it be better for rndstr() to use random = SystemRandom()? I'm not enough of an expert to say whether a CSPRNG is strictly necessary for all the places where rndstr is used, but maybe better safe than sorry?

[rohe]

In most if not all places it's used a cryptographically secure pseudo-random number is necessary but I agree that it's better to be safe then sorry so I'll change it.