Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

node.js only returns 8-bit values, regardless of array type #4

Closed
lgarron opened this issue Jul 5, 2015 · 2 comments
Closed

node.js only returns 8-bit values, regardless of array type #4

lgarron opened this issue Jul 5, 2015 · 2 comments
Labels

Comments

@lgarron
Copy link

lgarron commented Jul 5, 2015

https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback

This is extremely dangerous for anyone who is porting browser code, and assumes that this library will provide an interface that matches the standardized browser behaviour.
In cryptographic applications, asking for 32 bits of randomness and receiving a value with only 8 bits of entropy is... fatal. (And since the whole point here is to avoid Math.random(), it should be assumed that this library is for applications that expect cryptographic strength.)


Browser JS:

> var array = new Uint32Array(2);
> window.crypto.getRandomValues(array)
[2746395125, 1868657597]

Node:

> var getRandomValues = require('get-random-values');
undefined
> var array = new Uint32Array(2);
undefined
> getRandomValues(array);
undefined
> array
{ '0': 50,
  '1': 43,
  BYTES_PER_ELEMENT: 4,
  get: [Function: get],
  set: [Function: set],
  slice: [Function: slice],
  subarray: [Function: subarray],
  buffer:
   { '0': 50,
     '1': 0,
     '2': 0,
     '3': 0,
     '4': 43,
     '5': 0,
     '6': 0,
     '7': 0,
     slice: [Function: slice],
     byteLength: 8 },
  length: 2,
  byteOffset: 0,
  byteLength: 8 }
>
@kenany
Copy link
Owner

kenany commented Jul 6, 2015

@lgarron You are completely correct, thanks for catching this! I think a TypeError should be thrown if a Uint8Array is not passed as the argument. This way, the behavior can be consistent :)

@kenany kenany added the bug label Jul 6, 2015
@kenany kenany closed this as completed in de4919b Aug 24, 2015
@kenany
Copy link
Owner

kenany commented Aug 24, 2015

@lgarron I hope de4919b is an appropriate fix for this. I will let it sit for a bit while I decide whether to release this as a patch or as a major version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants