Request: use better source of entropy

[drathier]

Basing randomness on current time is very low entropy, at most 1000 unique values available per second, shared across all browsers in the world. Birthday paradox says 38 browsers loading the site in the same second have a 50% chance of at least one collision.

Can we please use WebCrypto.getRandomValues() for seeding the PRNG?

People generally assume two browsers fetching random values at the same time to get different values.

[HappMacDonald]

Or if performance is a concern, at least throw in a few other cheap entropy sources likely to be more unique per browser in a default, performance-oriented entropy pool and additionally offer swappable entropy pools so that more security conscious applications could choose the WebCrypto one? :)

[drathier]

No, just default to secure, and leave it at that. Performance shouldn't be a concern, at least not if we only seed it once.

[cmditch]

In case this is helpful for any future onlookers, here's an example of how one might use WebCrypto.getRandomValues() w/ elm/random to generate 20 char alphanumeric UIDs with more entropy than Time.now.

-- JS

Elm.Main.init({ 
  flags: { seeds: Array.from(crypto.getRandomValues(new Uint32Array(4))) } 
});


-- App


type alias Model =
    { seeds : List Random.Seed }


type alias Flags =
    { seeds : List Int }


init : Flags -> Model
init flags =
    { seeds = List.map Random.initialSeed flags.seeds }



-- UID Lib


generateUID : List Random.Seed -> ( String, List Random.Seed )
generateUID seeds =
    List.map (Random.step (alphaNumericGenerator 5)) seeds
        |> List.unzip
        |> Tuple.mapFirst (String.join "")


alphaNumericGenerator : Int -> Generator String
alphaNumericGenerator strLength =
    Random.Extra.choices (Random.Char.char 48 57)
        [ Random.Char.char 97 122
        , Random.Char.char 65 90
        ]
        |> Random.String.string strLength

I'm curious if anyone finds this approach misguided. My understanding essentially achieves a 128bit seed over the 32bit seed of Time.now.