How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG?
Like the specification says:
Implementations should generate cryptographically random values using well-established cryptographic pseudo-random number generators seeded with high-quality entropy, such as from an operating-system entropy source (e.g., "/dev/urandom").
If the OS gives sufficient entropy and the PRNG is cryptographically strong, that is a secure PRNG setup.
How can the method be trusted? Or is it event trustworthy?
If you don't trust the browser vendor to not be malicious, you can't do crypto in the browser, period.
E.g. WebKit-based browsers (
Chrome1, Safari) seem to use an ARC4-based RNG that drops the early keystream and mixes in OS entropy every ~1.5MB. That can be secure, if correctly implemented.
1 Nowadays Chrome and Chromium use Blink, which does not use ARC4, but uses OS RNGs directly.