fix: use SystemRandom for key generation fallback

Mark Atwoodrequested to merge
MarkAtwood/ntpsec:2026-06-fix-weak-rng into master

Summary

  • Replace random.randint() with random.SystemRandom().randint() in the fallback path when secrets module is unavailable

Rationale

random.randint() uses the Mersenne Twister PRNG which is not cryptographically secure. random.SystemRandom() uses os.urandom() — the same entropy source as secrets — making the fallback path secure on Python < 3.6.

Test plan

  • Verify syntax: python3 -m py_compile ntpclients/ntpkeygen.py
  • Generate keys on Python 2.7 system (if available) to confirm fallback path works

Merge request reports