# Are there any Javascript CSPRNGs? [closed]

I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can directly call (unless I missed it?). I've looked through the Stanford crypto js library, but I'm uncertain how much analysis this code has gotten. http://bitwiseshiftleft.github.io/sjcl/doc/symbols/sjcl.random.html

They appear to be implementing Schneier's Fortuna: http://sourceforge.net/projects/fortunaprng/

My question is there a well vetted crypto js library that has a well designed CSPRNG that generates values independently of some browser support? Or with a standard all modern browsers implement? And where is the entropy source? I'm used to crypto with languages like java and C++, not this fragmented world.

-

## closed as off-topic by owlstead, DrLecter, otus, poncho, GillesJul 25 at 20:57

• This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

–  archie Nov 2 '13 at 1:07
Not so much in my opinion, I'm asking a broader question than a particular implementation. I'm also concerned about javascript entropy sources. –  Charles Hoskinson Nov 2 '13 at 1:39
Thanks e-sushi for the edits –  Charles Hoskinson Nov 2 '13 at 7:10
This question appears to be off-topic because it is about implementations for a specific runtime. –  owlstead Jul 25 at 14:26
Your question is not clear: you say you want a CSPRNG, and then you talk about an entropy source. Do you need a CSRNG (unpredictable, i.e. at least seeded with a sufficient entropy source), or a CSPRNG (i.e. deterministic, but predictable only by knowing the secret seed)? –  Gilles Jul 25 at 20:57

I would try to avoid doing any cryptography using javascript… but that's just my personal opinion.

Anyway, if you really want to walk the Javascript path, you could skip the libraries and take a look at the window.crypto.getRandomValues() function, as long as you can live with the fact that it's an experimental API and not yet supported in all browsers… it should work on current versions of Firefox and Chrome though.

And for Opera, there's Math.Random() which has been implemented as a CSRNG. But you should be aware that Math.Random will only be a CSRNG in Opera (only in Opera, not any other browser!!!), and that the function will only return 53 bits of entropy on each call.

Besides that, I don't know of any further CSRNGs being available in Javascript, or in Javascript libraries.

EDIT

@CharlesHoskinson Well, as I noted, there's window.crypto.getRandomValues() and Opera's Math.Random(). With some browser detection code you can do a lot. Problem will be to get IE into the crypto bucket. –  e-sushi Nov 2 '13 at 6:05