Is there any built in browser support for crypto random numbers in IE and Webkit? Firefox has window.crypto

Question

Is there anything similar to https://developer.mozilla.org/en/javascript_crypto for IE or webkit browsers?

I just need to generate cryptographically secure pseudo-random numbers, but I don't want to have to include a large 3rd party js library.

Doesn't that link say that the random function is not implemented? — President James K. Polk, Nov 04 '10 at 00:19
By now `crypto.getRandomValues` is implemented in Firefox and Chrome. In Opera you can use `Math.random`, since they use a secure rng for it. With IE or older browsers things get ugly. — CodesInChaos, Aug 08 '13 at 09:41

score 1 · Answer 1 · answered Feb 03 '11 at 14:41

1

you should read into a buffer instead a directly into a string, as the above code will be UTF-8 encoded (why you have so many \0xFFFD bytes)

answered Feb 03 '11 at 14:41

lorrat

11
1

score 0 · Accepted Answer · answered Dec 13 '10 at 23:16

0

This is a fairly small SHA1 module that could be seeded with Date.now + some salt n pepper to provide a fairly random string. Strip out the alphas and keep calling until you have enough numbers for your needs.

http://www.movable-type.co.uk/scripts/sha1.html

Definitely hacky - so perhaps an ajax call to a webservice would suffice?

answered Dec 13 '10 at 23:16

Marcus Pope

2,293
20
25

3

This is definitely also not cryptographically secure! – Henning Klevjer Feb 13 '13 at 09:54

slacktracer · Answer 3 · 2010-12-25T05:29:46.840

0

I second the webservice idea and offer this suggestion: random.org, a truly random numbers generator.

edited Dec 25 '10 at 05:29

answered Dec 25 '10 at 01:20

slacktracer

6,262
6
28
33

3

Truly random they may be, but using a webservice is inherently not secure. – skeggse Jan 01 '12 at 03:49

score 0 · Answer 4 · edited Dec 02 '12 at 08:33

0

I noticed "crypto" in the Firefox 3 global scope, then found this reference.

Unfortunately, when I try crypto.random(8) in the JavaScript Error Console, it throws a NotImplemented error. I'd like to see this function made standard.

On node.js running on osx/linux I recommend this:

node> var urandom = fs.openSync('/dev/urandom', 'r');

node> fs.readSync(urandom, 8);

[ '.\ufffd\u000f\ufffdK!L\ufffd', 8 ]

I believe a synchronous read is ok, because /dev/urandom will always be non-blocking and doesn't rely on disk IO.

edited Dec 02 '12 at 08:33

mbinette

5,094
3
24
32

answered Jan 13 '11 at 18:20

Nathan Wilcox

1

2

If you're working with Node.js, look at the `crypto.randomBytes` function, which provides a buffer of cryptographically secure pseudo-random bytes. For a random integer, try `crypto.randomBytes(32).readInt32BE(0)` – skeggse Jan 01 '12 at 03:48

Is there any built in browser support for crypto random numbers in IE and Webkit? Firefox has window.crypto

4 Answers4

Linked