Proposal Details
Config.Rand has always been a wart, a testing hook exposed on the most important production Config of the crypto packages.
We broke it a few releases ago on the server side, when we added and enabled by default X25519MLKEM768, because the ML-KEM component does an Encapsulate that always uses default randomness. Nobody noticed.
Let's deprecate it, and point users to the new cryptotest.SetGlobalRandom (added in Go 1.26) which actually works. I managed to switch the crypto/tls test suite to cryptotest.SetGlobalRandom so it should be enough for everyone else's tests, too.
I will land this in Go 1.27 before the freeze if there are no objections, since it's really acknowledging something that has been broken since Go 1.24.
Proposal Details
Config.Randhas always been a wart, a testing hook exposed on the most important production Config of the crypto packages.We broke it a few releases ago on the server side, when we added and enabled by default X25519MLKEM768, because the ML-KEM component does an Encapsulate that always uses default randomness. Nobody noticed.
Let's deprecate it, and point users to the new
cryptotest.SetGlobalRandom(added in Go 1.26) which actually works. I managed to switch the crypto/tls test suite tocryptotest.SetGlobalRandomso it should be enough for everyone else's tests, too.I will land this in Go 1.27 before the freeze if there are no objections, since it's really acknowledging something that has been broken since Go 1.24.