The library BitcoinJS (https://github.com/bitcoinjs) has a method called makeRandom(). Where does its entropy (randomness) come from? Is it as secure as the method from http://bitaddress.org/ (moving around the mouse), or even more so?
Add a comment
|
1 Answer
This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as one's browser was not hacked.
-
Thank you, that was a big help. I think the phrase "Implementations are also required to use a seed with enough entropy, like a system-level entropy source." on the page you mentioned is interesting. So I guess, if I use bitcoinjs in my application, I would still have to provide a seed myself. If not I wonder where BitcoinJS takes it from. Commented Feb 14, 2018 at 13:13
-
@DalitSairio "system-level entropy source" is called by browsers. Browsers will ask the system for entropy, and the
getRandomValueswill be secure enough. You don't need to provide a seed.– MCCCSCommented Feb 14, 2018 at 13:37 -
@MCCCS please give your feedback on "easyseed(1) is also the first component for my campaign to urge that users stop using saved webpages to generate their Bitcoin magic bits. ... But most importantly, as a rule of thumb, Javascript code cannot reliably acquire proper entropy for generating random numbers. This is a persistent general problem, and specifically subject to extended fretting by the author[1] of the most popular BIP39 webpage. easyseed(1) reads bits straight off /dev/urandom, or from user-provided keymat." bitcointalk.org/index.php?topic=2664861.0– HansBKKCommented Apr 24, 2022 at 8:01