search

ulid / javascript

Universally Unique Lexicographically Sortable Identifier
MIT License
3.04k stars 107 forks source link

PRNG inconsistency #67

Open ooptimum opened 5 years ago

ooptimum commented 5 years ago

Disclaimer: I have not conducted any research into how the following affects information security or may lead to errors.

These pieces of code generate random numbers in the range from 0 to 1 inclusive, because you divide the value received from the browser or node by 255, not 256 (because 1 byte takes 256 different values, not 255): return buffer[0] / 0xff and nodeCrypto.randomBytes(1).readUInt8() / 0xff

While Math.random() used in case of absence of a good prng always returns a value less than 1. Moreover, your functions with good PRNG return only 256 different values, thus being much inferior even to Math.random().

perry-mitchell commented 4 years ago

This is a good point, regarding the granularity. Why not generate say 4 bytes to calculate the random number? Or more?