Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PRNG inconsistency #67

Open
ooptimum opened this issue Oct 19, 2019 · 1 comment
Open

PRNG inconsistency #67

ooptimum opened this issue Oct 19, 2019 · 1 comment

Comments

@ooptimum
Copy link

ooptimum commented Oct 19, 2019

Disclaimer: I have not conducted any research into how the following affects information security or may lead to errors.

These pieces of code generate random numbers in the range from 0 to 1 inclusive, because you divide the value received from the browser or node by 255, not 256 (because 1 byte takes 256 different values, not 255):
return buffer[0] / 0xff
and
nodeCrypto.randomBytes(1).readUInt8() / 0xff

While Math.random() used in case of absence of a good prng always returns a value less than 1.
Moreover, your functions with good PRNG return only 256 different values, thus being much inferior even to Math.random().

@perry-mitchell
Copy link

This is a good point, regarding the granularity. Why not generate say 4 bytes to calculate the random number? Or more?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants