An API for generating keys
diff --git a/cryptography/fernet.py b/cryptography/fernet.py
index 1c6cb5d..ba2ff4e 100644
--- a/cryptography/fernet.py
+++ b/cryptography/fernet.py
@@ -67,6 +67,10 @@
self.encryption_key = key[16:]
self.backend = backend
+ @classmethod
+ def generate_key(cls):
+ return base64.urlsafe_b64encode(os.urandom(32))
+
def encrypt(self, data):
current_time = int(time.time())
iv = os.urandom(16)
diff --git a/docs/fernet.rst b/docs/fernet.rst
index c95077b..241bf1e 100644
--- a/docs/fernet.rst
+++ b/docs/fernet.rst
@@ -3,13 +3,6 @@
.. currentmodule:: cryptography.fernet
-.. testsetup::
-
- import base64
- import binascii
- key = base64.urlsafe_b64encode(binascii.unhexlify(b"0" * 64))
-
-
`Fernet`_ is an implementation of symmetric (also known as "secret key")
authenticated cryptography. Fernet provides guarantees that a message encrypted
using it cannot be manipulated or read without the key.
@@ -21,6 +14,7 @@
.. doctest::
>>> from cryptography.fernet import Fernet
+ >>> key = Fernet.generate_key()
>>> f = Fernet(key)
>>> ciphertext = f.encrypt(b"my deep dark secret")
>>> ciphertext
@@ -32,6 +26,11 @@
kept secret. Anyone with this key is able to create and
read messages.
+ .. classmethod:: generate_key()
+
+ Generates a fresh fernet key. Keep this some place safe! If you lose it
+ you'll no longer be able to decrypt messages; if anyone else gains
+ access to it, they'll be able to decrypt all of your messages.
.. method:: encrypt(plaintext)
diff --git a/tests/test_fernet.py b/tests/test_fernet.py
index 8759229..af64175 100644
--- a/tests/test_fernet.py
+++ b/tests/test_fernet.py
@@ -76,5 +76,5 @@
@pytest.mark.parametrize("message", [b"", b"Abc!", b"\x00\xFF\x00\x80"])
def test_roundtrips(self, message):
- f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32))
+ f = Fernet(Fernet.generate_key())
assert f.decrypt(f.encrypt(message)) == message