I am writing a key generator program.
Indeed it generates a key in the form of a random text string (not binary), with its characters chosen randomly from a set of defined characters, with a specified length.
You can see an example of my program's config.ini file for clarification:
[general] key_chars = abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789 key_len = 22 pepper = G89ne_^DFIM"]12@\z2's#GBA
Ignoring the pepper part, we can generate the desired key with a code like this (code is in Python language):
Warning: The following code is not secure! *
def generate(self, keyLen, keyChars): key='' for i in range(keyLen): randIndex=randint(0, len(keyChars)) key+=keyChars[randIndex] return key
But I don't want my keys' security rely solely on the OS/Language (presumably) secure random generator (In this case, pycrypto module's CSPRNG that probably itself uses OS' CSPRNG under the hood), so I want to engage the pepper in the procedure too, but I am not sure about the proper way to do that securely. Please tell me how to combine the pepper in the above code (Or maybe you suggest a different method for doing that which is better suited to such purpose).
*: I used randint in my example code because I thought it is part of pycrypto module, then I realized that is not the case!