crypto-utils / uid-safe Goto Github PK
View Code? Open in Web Editor NEWURL and cookie safe UIDs
License: MIT License
URL and cookie safe UIDs
License: MIT License
In the doc:
"To use promises, you must define a global Promise if necessary."
Maybe it's obvious for readers already familiar with Promises (especially in the context of a Node.js environment), but for those new to it, a tad more details would be helpful.
The way it is phrased right now, it makes it seem as if you are expected to implement this yourself.
Something like this might be more helpful:
"To use promises, a global Promise variable must be defined in your environment. This is not the case for current versions of Node.js, but it can be achieved with a polyfill like the one in the es6-promise project."
Hello,
In package.json I see:
"repository": "jonathanong/uid-safe",
But the real project homepage seems to be "crypto-utils/uid-safe/"
Can you please consider to update it ?
As I read from node docs here: http://nodejs.org/api/crypto.html#crypto_crypto_pseudorandombytes_size_callback it is stated that these may be predictable.
I think this module should use crypto.randomBytes
instead.
I am not an expert on it and just curious about it. Why are these characters insecure? Thank you!
Hi,
is it really needed require 'mz/crypto' ??
I mean, could module be rewritten doing the same job without install extra 600KB dependencies ?
I saw a portion in the source code where = at the end of the string after base64 is replaced with an empty string. If that's the case should a specific length return of generated uids expected?
Potentially vulnerable to an attack where entropy is exhausted and the library falls back to predictable random byte generation.
Code should warn the operator when entropy is exhausted to detect attack.
The code tries crypto.randomBytes and silently falls back to crypto.pseudoRandomBytes which can happen if entropy is exhausted.
function randomBytes(length, callback) {
crypto.randomBytes(length, function (err, buf) {
if (!err) return callback(null, buf)
crypto.pseudoRandomBytes(length, function (err, buf) {
if (err) return callback(err)
callback(null, buf)
})
})
}
Notes from crypto documentation:
NOTE: Will throw error or invoke callback with error, if there is not enough accumulated entropy to generate cryptographically strong data. In other words, crypto.randomBytes without callback will not block even if all entropy sources are drained.
[crypto.pseudoRandomBytes] Generates non-cryptographically strong pseudo-random data. The data returned will be unique if it is sufficiently long, but is not necessarily unpredictable. For this reason, the output of this function should never be used where unpredictability is important, such as in the generation of encryption keys.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.