Skip to content

node.js only returns 8-bit values, regardless of array type #4

@lgarron

Description

@lgarron

https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback

This is extremely dangerous for anyone who is porting browser code, and assumes that this library will provide an interface that matches the standardized browser behaviour.
In cryptographic applications, asking for 32 bits of randomness and receiving a value with only 8 bits of entropy is... fatal. (And since the whole point here is to avoid Math.random(), it should be assumed that this library is for applications that expect cryptographic strength.)


Browser JS:

> var array = new Uint32Array(2);
> window.crypto.getRandomValues(array)
[2746395125, 1868657597]

Node:

> var getRandomValues = require('get-random-values');
undefined
> var array = new Uint32Array(2);
undefined
> getRandomValues(array);
undefined
> array
{ '0': 50,
  '1': 43,
  BYTES_PER_ELEMENT: 4,
  get: [Function: get],
  set: [Function: set],
  slice: [Function: slice],
  subarray: [Function: subarray],
  buffer:
   { '0': 50,
     '1': 0,
     '2': 0,
     '3': 0,
     '4': 43,
     '5': 0,
     '6': 0,
     '7': 0,
     slice: [Function: slice],
     byteLength: 8 },
  length: 2,
  byteOffset: 0,
  byteLength: 8 }
>

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions