Open bojanz opened 4 months ago
Looks like this is not a simple drop-in replacement because the new Rand does not have a Read() method (yet): https://github.com/golang/go/issues/65562 https://github.com/golang/go/issues/67059
Is the benefit purely or mostly derived from the additional entropy of the initial seed?
Twice as slow, even at the level of single-digit nanoseconds, is actually potentially meaningful for this package. I'll play around with the new package, let's see.
Looks like this is not a simple drop-in replacement because the new Rand does not have a Read() method (yet): golang/go#65562 golang/go#67059
It's intended. math/rand.Read
has been deprecated: https://pkg.go.dev/math/rand@master#Read
It should use crypto/rand
when a non-deterministic source is enough, or an algorithm from math/rand/v2
FWIW https://github.com/golang/go/issues/67059 got accepted and merged, so rand.ChaCha8 will be a drop-in replacement from Go 1.23.
I have been looking into google/uuid v7 implementation. By default, crypto/rand.Read
is used in NewRandom
unless NewRandomFromReader
is explicitly preferred.
Probably, that should be the default behavior which is also inline with the aforementioned deprecation.
defaultEntropy() uses math/rand in order to be fast by default:
Go 1.22 introduces math/rand/v2 which uses the ChaCha8Rand generator, greatly improving security with a minimal performance cost. From today's blog post:
So, requiring Go 1.22 and switching defaultEntropy to math/rand/v2 sounds like a win.