feat: introduce Math.getRandomValues() #33
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bakkot
approved these changes
Oct 13, 2019
ctavan
approved these changes
Oct 13, 2019
|
@littledan @ljharb any opinions on this topic, I was wondering if there's prior art with regards to adopting a recommendation from W3C. |
|
Not that I know of, but I'd expect to see the spec for it upstreamed, ie not have 262 just point to HTML. |
This was referenced Oct 29, 2019
Closed
|
Yes, I am all for this, but let's work closely with the WebCrypto people here. Do we want this to be the same function, or a similar function? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming out of conversations in #25, and #31, I would like to advocate that the best option I've heard so far for facilitating the need for a mockable, secure source of randomness, to act as a foundation for UUID algorithms, would be the introduction of an API identical to
crypto.getRandomValues().I'm looping in a couple fo the folks who have worked on the Web Cryptography API, to see if they have any additional advice 😄 ....
@mwatson(@mwatson2), @plehegar, to give you some context, we're working on a proposal to add cryptographically secure UUIDs to ECMAScript, and the idea has been floated that we use an API resemblingcrypto.getRandomValues()for the foundation of the algorithm.see: #25, #31, #32