search

polycrypt / polycrypt

PolyCrypt - A pure JS implementation of the WebCrypto API
Other
266 stars 21 forks source link

using Math.random() to seed RNGs is not secure #4

Open jfn12587 opened 11 years ago

jfn12587 commented 11 years ago

This implementation uses WebWorkers which have no access to the underlying window.crypto API that modern browsers implement to provide access to, among other things, cryptographically strong PRNGs. JSBN attempts to seed its pool from window.crypto, or, failing that, it just dumps a bunch of numbers in from Math.random() which is NOT suitable for cryptography.

This library is useful as a polyfill, but what's the point exactly if it's not secure?

bifurcation commented 11 years ago

As we note on our project page [http://polycrypt.net/], this polyfill is not intended for use in production, for securing real data.

I would think of this instead as a design / prototyping tool -- you can build your code against PolyCrypt until there's some real browser support, then remove the Githubissues.

  • Githubissues is a development platform for aggregating issues.