"Daniel Fairs" <daniel.fairs@spiderplant.net>

...

And additionally - instead of using hashes - just to use a timestamp?

The key thing I need is unpredictability - hence my originally wanting to use md5 as the last step in the generation. The 'usual' way to do this is to seed the random number generator with the current time, pull a number out of that and then do an md5 on it. I've got a number of options now, I'll look at them

However, this doesn't answer the first part of my original question - why is Zope asking me for further credentials when I try to use the md5 module? I'm guessing md5 is in the security sin bin along with re and other stuff... but why md5?

It isn't a "sin bin"; TTW-scripting (PythonScripts, and, in 2.4, DTML) have a "deny by default" access policy for Python modules; you can "bless" the md5 module using a "patch-style" product, as described in the PythonScript product's README ('lib/python/Products/PythonScripts/README.txt'). You can use an ExternalMethod, if you prefer not to go this route. Tres. -- =============================================================== Tres Seaver tseaver@digicool.com Digital Creations "Zope Dealers" http://www.zope.org