Cómo a Generar Random Números

问题

You necesitar random números para seguridad purposes, testing, o simulation, y debe ensure proper randomness.

Requisitos previos

• Understanding of PRNG vs CSPRNG
• Knowledge of random number ranges

Pasos

1. 1. Choose the right generator

   For security purposes (tokens, keys, passwords), use a cryptographically secure PRNG (CSPRNG): crypto.getRandomValues in browsers, crypto.randomBytes in Node.js. For non-security uses (testing, simulation), Math.random is faster but not secure. Never use Math.random for security.

   entrada

   purpose: security token

   输出

   use CSPRNG

2. 2. Generate within the desired range

   For a random integer in [min, max], generate random bytes and map to the range. Avoid modulo bias: use rejection sampling or generate enough bits to cover the range uniformly. For random floats in [0, 1), divide a large random integer by its maximum value.

   entrada

   range: [1, 100]

   输出

   42 (uniform)

3. 3. Generate other random types

   For random bytes (e.g., for a key), generate the required number of bytes directly. For random hex strings, convert the bytes to hex. For UUIDs, use the dedicated UUID generator. For random selections from an array, use a random index.

   entrada

   32 random bytes

   输出

   a1b2c3... (64 hex chars)

Resultado esperado

Random valores generado con el appropriate nivel de seguridad y uniformity.

Errores comunes

Modulo bias when using % to range

Using randomNumber % range produces biased results when the range doesn't evenly divide the generator's range. Use rejection sampling or crypto.randomInt for unbiased results.

Using Math.random for security

Math.random is predictable and not cryptographically secure. Always use crypto.getRandomValues or crypto.randomBytes for security-sensitive randomness.

Solución de problemas指引

• If random values seem predictable, verify you are using a CSPRNG.
• For large numbers of random values, check the distribution for uniformity.

Límites de seguridad

• All random generation is local. No random values are transmitted.
• CSPRNG output is unpredictable and suitable for security tokens, keys, and nonces.