You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is extremely dangerous for anyone who is porting browser code, and assumes that this library will provide an interface that matches the standardized browser behaviour.
In cryptographic applications, asking for 32 bits of randomness and receiving a value with only 8 bits of entropy is... fatal. (And since the whole point here is to avoid Math.random(), it should be assumed that this library is for applications that expect cryptographic strength.)
Browser JS:
> var array = new Uint32Array(2);
> window.crypto.getRandomValues(array)
[2746395125, 1868657597]
@lgarron You are completely correct, thanks for catching this! I think a TypeError should be thrown if a Uint8Array is not passed as the argument. This way, the behavior can be consistent :)
@lgarron I hope de4919b is an appropriate fix for this. I will let it sit for a bit while I decide whether to release this as a patch or as a major version.
https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback
This is extremely dangerous for anyone who is porting browser code, and assumes that this library will provide an interface that matches the standardized browser behaviour.
In cryptographic applications, asking for 32 bits of randomness and receiving a value with only 8 bits of entropy is... fatal. (And since the whole point here is to avoid Math.random(), it should be assumed that this library is for applications that expect cryptographic strength.)
Browser JS:
Node:
The text was updated successfully, but these errors were encountered: