How to combine pepper in random string generation I am writing a key generator program.

Indeed it generates a key in the form of a random text string (not binary), with its characters chosen randomly from a set of defined characters, with a specified length.

You can see an example of my program's config.ini file for clarification:

[general]
key_chars = abcdefghijklmnopqrstuvwxyz
            ABCDEFGHIJKLMNOPQRSTUVWXYZ
            0123456789
key_len = 22
pepper = G89ne_^DFIM"]12@\z2's#GBA


Ignoring the pepper part, we can generate the desired key with a code like this (code is in Python language):

Warning: The following code is not secure! *

def generate(self, keyLen, keyChars):
    key=''
    for i in range(keyLen):
        randIndex=randint(0, len(keyChars))
        key+=keyChars[randIndex]
    return key


But I don't want my keys' security rely solely on the OS/Language (presumably) secure random generator (In this case, pycrypto module's CSPRNG that probably itself uses OS' CSPRNG under the hood), so I want to engage the pepper in the procedure too, but I am not sure about the proper way to do that securely. Please tell me how to combine the pepper in the above code (Or maybe you suggest a different method for doing that which is better suited to such purpose).

*: I used randint in my example code because I thought it is part of pycrypto module, then I realized that is not the case!
First of all, you should just trust the random source that the OS provides and call it via os.urandom(n). Not only is it generally safe, but if your OS is unsafe you may have bigger problems on your hands.

If you really do want to use your pepper as an input to the random bytes that are generated, the obvious way would be to encrypt the OS's stream using a block cipher. You then use the ciphertext as your new random source.