0

I am writing some code that shall run in a browser, which uses Javascript random function(s) for key generation.

Now reading in several forums that this is considered to be not secure, due to bad random number generation.

Now, what if I only create one key pair per browser/computer. So, having a distributed scenario where there is actually no sequence of random numbers per browser. Will this fundamentally change the problematic situation? Thanks for your thoughts.

Benjamin Lorenz
  • 1

2 Answers2

2

Yes it matters. If an attacker generates random numbers at the same time as a genuine user, they can predict what is generated and retrieve they key. Even if the clocks aren't fully synchronised, an attacker could generate a range around the UNIX timestamp when the key was known to have been generated and then try each one in turn.

Solution: Use window.crypto to generate a secure random number using the crypto library.

The Crypto interface represents basic cryptography features available in the current context. It allows access to a cryptographically strong random number generator and to cryptographic primitives.

SilverlightFox
  • 32,436
  • 11
  • 76
  • 145
0

Random numbers are generated in Javascript by the amount of milliseconds since 1st of January 1970(UNIX Timestamp). Then Javascript just takes the first few values and that is your random number. i.e. 

Math.floor((Math.random() * 10) + 1);

Makes a random number between 1 and 10.

SomeNorwegianGuy
  • 1,494
  • 4
  • 17
  • 43
ComputerNerd1012
  • 1
  • 2