3 ms·
> “Each Math.random function created for distinct realms must produce a distinct sequence of values from successive calls.” If this were not true, it would hav
by xsmasher 6y ago
> “Each Math.random function created for distinct realms must produce a distinct sequence of values from successive calls.”
If this were not true, it would have security implications.
Thought experiment:
If there was a single state then a web page could pull a bunch of numbers, use that data to derive the seed AND the next number that will be pulled without pulling it.
Then the predictor page can STOP pulling numbers when they know the next number is an auspicious one. The predictor page has now successfully "rigged" the dice roll for another page that shares the same state.
- Someone 6y agoI know that an am not disputing it. My claim is that most, if not all, implementations do not satisfy that requirement. Also, that requirement isn’t sufficient to prevent such attacks, by a long stretch. An implementation that has only one sequence of random numbers r1, r2, r3, r4…, but drops a single item of the sequence for each subsequent realm (the second instance returns r2, r3, r4…, the third one r3, r4…, etc.) satisfies the requirement, and the individual sequences are as perfectly random as the original one), but still is vulnerable to attacks. And it can be worse: an implementation that generates a unique r0 for each realm (could even be an easily predictable value) and returns r0, r1, r2, r3, r4…, with r1 and subsequent identical for all instances also satisfies the requirement.