4 ms·
In that vein, Javascript's Math.random, while the implementation is JS-engine specific (so I'm hesitant to condemn it across the board), hardly qualifies as a C
by paulbaumgart 17y ago
In that vein, Javascript's Math.random, while the implementation is JS-engine specific (so I'm hesitant to condemn it across the board), hardly qualifies as a CSPRNG either.
- tptacek 17y agoNo, it doesn't; that's why you're supposed to use java.security.SecureRandom.
- paulbaumgart 17y agoSo, you're saying in effect there's no way to properly do encryption in pure JavaScript at all? That you'd have to get the random numbers from a Java applet or something of the sort? I came across this attempt: http://tim.dierks.org/2007/03/secure-in-browser-javascript-password.html http://tim.dierks.org/2007/03/secure-in-browser-javascript-p... But Billy Hoffman disapproves: http://www.webappsec.org/lists/websecurity/archive/2008-01/msg00111.html http://www.webappsec.org/lists/websecurity/archive/2008-01/m...
- tptacek 17y agoI misread your original comment, saw the "Java" and not the "script". You're right. So far as I know, there's no cross-platform way to get secure random numbers from Javascript. You can, for instance, get them from Mozilla from the "crypto" interface. This is another reason why Javascript crypto is a bad idea.