如何Generate Random Numbers
生成 cryptographically secure random numbers, integers, and bytes.
问题
你 need random numbers 为安全 purposes, testing, 或 simulation, 和必须确保 proper randomness.
前置条件
- Understanding 的 PRNG vs CSPRNG
- Knowledge 的 random 数字 ranges
步骤
-
1. Choose the right generator
For security purposes (tokens, keys, passwords), use a cryptographically secure PRNG (CSPRNG): crypto.getRandomValues in browsers, crypto.randomBytes in Node.js. For non-security uses (testing, simulation), Math.random is faster but not secure. Never use Math.random for security.
输入purpose: security token输出use CSPRNG -
2. Generate within the desired range
For a random integer in [min, max], generate random bytes and map to the range. Avoid modulo bias: use rejection sampling or generate enough bits to cover the range uniformly. For random floats in [0, 1), divide a large random integer by its maximum value.
输入range: [1, 100]输出42 (uniform) -
3. Generate other random types
For random bytes (e.g., for a key), generate the required number of bytes directly. For random hex strings, convert the bytes to hex. For UUIDs, use the dedicated UUID generator. For random selections from an array, use a random index.
输入32 random bytes输出a1b2c3... (64 hex chars)
预期结果
Random values generated 具有 appropriate 级别的 安全和 uniformity.
常见错误
- Modulo bias when using % to range
- Using randomNumber % range produces biased results when the range doesn't evenly divide the generator's range. Use rejection sampling or crypto.randomInt for unbiased results.
- Using Math.random for security
- Math.random is predictable and not cryptographically secure. Always use crypto.getRandomValues or crypto.randomBytes for security-sensitive randomness.
排障指引
- If random values seem predictable, verify you are using a CSPRNG.
- For large numbers of random values, check the distribution for uniformity.
安全限制
- All random generation is local. No random values are transmitted.
- CSPRNG output is unpredictable and suitable for security tokens, keys, and nonces.