3 ms·
JavaScript's Math.random (and most languages' default RNGs) is not intended to be cryptographically secure, so I'm not sure "broken" is correct. It's probably r
by tlrobinson 11y ago
JavaScript's Math.random (and most languages' default RNGs) is not intended to be cryptographically secure, so I'm not sure "broken" is correct. It's probably random enough for most uses that don't require a CSPRNG. Are there any scenarios where this isn't the case?
On the other hand, enough people make this mistake that APIs should just use a CSPRNG for "random()" and offer a "fastRandom()" for those who need speed but not "secure" random.
- panic 11y agoStatistical simulations require good randomness (or your simulation might give a wrong result) and high speed but not cryptographic security. See, for example, xorshift* (http://xorshift.di.unimi.it http://xorshift.di.unimi.it), which is efficient and high-quality but not cryptographically secure.
- dahart 11y agoMy personal definition of random includes the requirement that plotting the bits must look random, and have no visible signs of pattern. The OP did that and you can see patterns. If plotting a picture of a PRNG's bits has visible patterns, I definitely call it completely broken.