Previous releases of gensafeprime up to 1.3 used the OpenSSL library to generate safe prime numbers, but did not add a seed to the OpenSSL PRNG. As a result, it might be possible that these numbers can be guessed. The manpage of OpenSSL BN_generate_prime specifies:

The PRNG must be seeded prior to calling BN_generate_prime(). The prime number generation has a negligible error probability.

To fix that problem, gensafeprime 1.4 has been released. The release contains a patch that seeds the OpenSSL PRNG from the python os.urandom source of entropy, which should be sufficient for cryptographic applications.

All users of the previous versions are encouraged to update to gensafeprime 1.4.

I have started to write about mostly applied aspects of cryptographie, cryptanalysis and security on http://cryptanalysis.eu/. Postings for these topics won’t appear here.