-
Notifications
You must be signed in to change notification settings - Fork 7
Closed
Labels
Description
https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback
This is extremely dangerous for anyone who is porting browser code, and assumes that this library will provide an interface that matches the standardized browser behaviour.
In cryptographic applications, asking for 32 bits of randomness and receiving a value with only 8 bits of entropy is... fatal. (And since the whole point here is to avoid Math.random(), it should be assumed that this library is for applications that expect cryptographic strength.)
Browser JS:
> var array = new Uint32Array(2);
> window.crypto.getRandomValues(array)
[2746395125, 1868657597]
Node:
> var getRandomValues = require('get-random-values');
undefined
> var array = new Uint32Array(2);
undefined
> getRandomValues(array);
undefined
> array
{ '0': 50,
'1': 43,
BYTES_PER_ELEMENT: 4,
get: [Function: get],
set: [Function: set],
slice: [Function: slice],
subarray: [Function: subarray],
buffer:
{ '0': 50,
'1': 0,
'2': 0,
'3': 0,
'4': 43,
'5': 0,
'6': 0,
'7': 0,
slice: [Function: slice],
byteLength: 8 },
length: 2,
byteOffset: 0,
byteLength: 8 }
>