Skip to content

Bad advice in README.md #2

@atoponce

Description

@atoponce

Emphasis mine:

Use this to quickly generate random numbers with good statistical properties. NOTE: This generator is not cryptographically secure. If you need a secure generator then consider ISAAC for your application: a fast, long-period generator and discrete message cipher.

When you need cryptographic security, you should not be using user space generators. Instead, you should be using the system's CSPRNG via window.crypto.getRandomValues() which is available in every modern JavaScript implementation, both client browsers and server-side frameworks. Further, ISAAC is vulnerable to known plaintext attacks (2001). Additional analysis demonstrating further weaknesses (2006).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions