Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

src: use V8 entropy source if RAND_bytes() != 1 #44493

Merged
merged 1 commit into from Sep 4, 2022
Merged

src: use V8 entropy source if RAND_bytes() != 1 #44493

merged 1 commit into from Sep 4, 2022

Commits on Sep 2, 2022

  1. src: use V8 entropy source if RAND_bytes() != 1 

    RAND_bytes() may return 0 to indicate an error, in which case the buffer
might not have been filled with random data at all. Instead of ignoring
this case, let V8 use its own entropy source. Historically, this used to
be a weak source of entropy, but V8 now implements a proper source even
on Windows. And even if V8's own entropy source turns out to be weak, it
does not matter much: V8's PRNG itself is not cryptographically secure,
so even if it is seeded from a cryptographically secure entropy source,
it does not produce cryptographically secure random numbers.
    @tniessen
    tniessen committed Sep 2, 2022
    Configuration menu
    Copy the full SHA
    456c91d View commit details
    Browse the repository at this point in the history