homepage

crypt.mksalt() creates a salt with a lower entropy than possible. It uses random.SystemRandom().sample() to generate a salt string from the set of 64 chars (string.ascii_letters + string.digits + './'). SystemRandom() uses a CPRNG (good) but sample() returns n UNIQUE members of the set (very bad). sample() reduces the set possible chars by one for each salt char.
Suggested fix:
salt = base64.b64encode(os.urandom(salt_chars * 3 // 4), b"./").decode("ascii")

I prefer to avoid conversion to/from base64, and use random.choice() instead: see attached patch.

New changeset e8a314fe248b by Victor Stinner in branch '3.3':
Issue #18405: Improve the entropy of crypt.mksalt().
http://hg.python.org/cpython/rev/e8a314fe248b
New changeset 122e074c56f7 by Victor Stinner in branch 'default':
(Merge 3.3) Issue #18405: Improve the entropy of crypt.mksalt().
http://hg.python.org/cpython/rev/122e074c56f7 

With my change, any character can appear more than once. Example:
>>> crypt.mksalt()
'6ドル$idm7/asaywTgRf9V'
>>> sorted(_[3:])
['/', '7', '9', 'R', 'T', 'V', 'a', 'a', 'd', 'f', 'g', 'i', 'm', 's', 'w', 'y']
In this case, the 'a' letter occurs twice.