1

The library BitcoinJS (https://github.com/bitcoinjs) has a method called makeRandom(). Where does its entropy (randomness) come from? Is it as secure as the method from http://bitaddress.org/ (moving around the mouse), or even more so?

1 Answer 1

1

This code calls this code, which calls crypto.getRandomValues, which is a trustworthy cryptographically secure random number generator. It's secure enough to compete with bitaddress.org, as long as one's browser was not hacked.

3
  • Thank you, that was a big help. I think the phrase "Implementations are also required to use a seed with enough entropy, like a system-level entropy source." on the page you mentioned is interesting. So I guess, if I use bitcoinjs in my application, I would still have to provide a seed myself. If not I wonder where BitcoinJS takes it from. Feb 14, 2018 at 13:13
  • @DalitSairio "system-level entropy source" is called by browsers. Browsers will ask the system for entropy, and the getRandomValues will be secure enough. You don't need to provide a seed.
    – MCCCS
    Feb 14, 2018 at 13:37
  • @MCCCS please give your feedback on "easyseed(1) is also the first component for my campaign to urge that users stop using saved webpages to generate their Bitcoin magic bits. ... But most importantly, as a rule of thumb, Javascript code cannot reliably acquire proper entropy for generating random numbers. This is a persistent general problem, and specifically subject to extended fretting by the author[1] of the most popular BIP39 webpage. easyseed(1) reads bits straight off /dev/urandom, or from user-provided keymat." bitcointalk.org/index.php?topic=2664861.0
    – HansBKK
    Apr 24 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.