all: Use crypt/rand through its buffered version, but not in benchmarks (#7420)

lib/rand/random.go

@@ -9,13 +9,17 @@
 package rand
 
 import (
-	cryptoRand "crypto/rand"
+	"io"
 	mathRand "math/rand"
 	"reflect"
 )
 
-// Reader is the standard crypto/rand.Reader, re-exported for convenience
-var Reader = cryptoRand.Reader
+// Reader is the standard crypto/rand.Reader with added buffering.
+var Reader = defaultSecureSource
+
+func Read(p []byte) (int, error) {
+	return io.ReadFull(defaultSecureSource, p)
+}
 
 // randomCharset contains the characters that can make up a rand.String().
 const randomCharset = "2345679abcdefghijkmnopqrstuvwxyzACDEFGHJKLMNPQRSTUVWXYZ"

lib/rand/securesource.go

@@ -14,7 +14,7 @@ import (
 	"sync"
 )
 
-// The secureSource is a math/rand.Source that reads bytes from
+// The secureSource is a math/rand.Source + io.Reader that reads bytes from
 // crypto/rand.Reader. It means we can use the convenience functions
 // provided by math/rand.Rand on top of a secure source of numbers. It is
 // concurrency safe for ease of use.
@@ -40,6 +40,12 @@ func (s *secureSource) Int63() int64 {
 	return int64(s.Uint64() & (1<<63 - 1))
 }
 
+func (s *secureSource) Read(p []byte) (int, error) {
+	s.mut.Lock()
+	defer s.mut.Unlock()
+	return s.rd.Read(p)
+}
+
 func (s *secureSource) Uint64() uint64 {
 	var buf [8]byte