6
$\begingroup$

I'm writing some software that requires the use of a CSPRNG with javascript for use in the browser and I'm wondering what libraries are available. Crypto-js doesn't seem to have a CSPRNG I can directly call (unless I missed it?). I've looked through the Stanford crypto js library, but I'm uncertain how much analysis this code has gotten. http://bitwiseshiftleft.github.io/sjcl/doc/symbols/sjcl.random.html

They appear to be implementing Schneier's Fortuna: http://sourceforge.net/projects/fortunaprng/

I've also seen https://www.clipperz.com/open_source/javascript_crypto_library/.

My question is there a well vetted crypto js library that has a well designed CSPRNG that generates values independently of some browser support? Or with a standard all modern browsers implement? And where is the entropy source? I'm used to crypto with languages like java and C++, not this fragmented world.

$\endgroup$
  • $\begingroup$ Your question is not clear: you say you want a CSPRNG, and then you talk about an entropy source. Do you need a CSRNG (unpredictable, i.e. at least seeded with a sufficient entropy source), or a CSPRNG (i.e. deterministic, but predictable only by knowing the secret seed)? $\endgroup$ – Gilles 'SO- stop being evil' Jul 25 '14 at 20:57
2
$\begingroup$

I would try to avoid doing any cryptography using javascript… but that's just my personal opinion.

Anyway, if you really want to walk the Javascript path, you could skip the libraries and take a look at the window.crypto.getRandomValues() function, as long as you can live with the fact that it's an experimental API and not yet supported in all browsers… it should work on current versions of Firefox and Chrome though.

And for Opera, there's Math.Random() which has been implemented as a CSRNG. But you should be aware that Math.Random will only be a CSRNG in Opera (only in Opera, not any other browser!!!), and that the function will only return 53 bits of entropy on each call.

Besides that, I don't know of any further CSRNGs being available in Javascript, or in Javascript libraries.

EDIT

Some stuff that might help you find solutions to your quest:

$\endgroup$
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – e-sushi Jul 7 '18 at 23:52

protected by e-sushi Dec 7 '17 at 8:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.