Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

feat: introduce Math.getRandomValues() #33

Merged
merged 3 commits into from
Oct 29, 2019
Merged

feat: introduce Math.getRandomValues() #33

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8d80a99
feat: introduce Math.getRandomValues()
bcoe Oct 12, 2019
95906b1
chore: fix links
bcoe Oct 12, 2019
14add23
chore: address review
bcoe Oct 13, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ developers from security pitfalls.

## Overview

### UUID API

The UUID standard library provides an API for generating RFC 4122 identifiers.

The default export of the UUID library is the
Expand All @@ -51,8 +53,22 @@ representation _(as described in RFC-4122)_.
uuid(); // "52e6953d-edbe-4953-be2e-65ed3836b2f0"
```

All random values in UUIDs produced by this API must be generated from a **[cryptographically
secure][csprng]** source.
### `Math.getRandomValues()`

`Math.getRandomValues()` exposes an identical API to the
[W3C `crypto.getRandomValues()`](https://www.w3.org/TR/WebCryptoAPI/#Crypto-method-getRandomValues)
recommendation. With the same guarantees, regarding the quality of randomness:

> Implementations should generate cryptographically random values using well-established
> cryptographic pseudo-random number generators seeded with high-quality entropy, such as from an
> operating-system entropy source (e.g., "/dev/urandom"). This specification provides no
> lower-bound on the information theoretic entropy present in cryptographically random values, but
> implementations should make a best effort to provide as much entropy as practicable.
>
> - [WebCryptoAPI 10.1. Description](https://www.w3.org/TR/WebCryptoAPI/#Crypto-description)

`Math.getRandomValues()` will act as the foundation for implementing UUID algorithms, providing a
single mockable (see [#25](https://github.com/tc39/proposal-uuid/issues/25)) source of randomness.

## Out of scope

Expand Down