crypto#randomBytes有多随机? [英] How random is crypto#randomBytes?

问题描述

crypto.randomBytes(20).toString('hex')的随机性如何?

那样简单，我需要知道的一切.

Easy as that, all I need to know.

推荐答案

crypto.randomBytes()的随机性如何?通常，足够的随机性可以满足您所需的任何目的.

How random is crypto.randomBytes()? Usually, random enough for whatever purpose you need.

crypto.randomBytes() 生成具有加密安全性的随机数据:

crypto.randomBytes(size [，回调])

生成具有强大加密功能的伪随机数据. size参数是一个数字，指示要生成的字节数.

crypto.randomBytes(size[, callback])

Generates cryptographically strong pseudo-random data. The size argument is a number indicating the number of bytes to generate.

这意味着随机数据足够安全以用于加密目的.实际上，该功能是只是OpenSSL的包装 RAND_bytes() 函数. 他们的文档的这一部分指出:

This means that the random data is secure enough to use for encryption purposes. In fact, the function is just a wrapper around OpenSSL's RAND_bytes() function. This part of their documentation states:

RAND_bytes将获取具有加密强度的随机字节.加密强度高的字节适合于高完整性需求，例如长期密钥生成.如果您的生成器使用软件算法，则字节将是伪随机的(但仍具有加密强度).

RAND_bytes will fetch cryptographically strong random bytes. Cryptographically strong bytes are suitable for high integrity needs, such as long term key generation. If your generator is using a software algorithm, then the bytes will be pseudo-random (but still cryptographically strong).

除非您具有硬件随机数生成器，否则这些字节将是伪随机-根据种子值可预测地生成.种子是从特定于操作系统的源(在Unix-像系统，在Windows上是CryptGenRandom.只要您的种子是相对随机的，并且攻击者不知道，则生成的数据将显示为完全随机.

Unless you have a hardware random number generator, the bytes will be pseudo-random—generated predictably from a seed value. The seed is generated from an OS-specific source (/dev/urandom on Unix-like systems, CryptGenRandom on Windows). As long as your seed is relatively random and not known to an attacker, the data produced will appear totally random.

如果愿意，您可以在此处进行测试:

If you like, you could perform the test described here:

给定任意的二进制数字序列，可以使用统计技术对其进行检查. NIST的随机数生成"页面提供了各种统计测试套件，例如STS(统计测试套件).该套件提供了许多不同的测试，包括:

Given any arbitrary sequence of binary digits it is possible to examine it using statistical techniques. There are various suites of statistical tests available such as STS (Statistical Test Suite) available from NIST's RANDOM NUMBER GENERATION page. This suite provides a number of different tests including:

• 频率(单比特)测试:检查给定序列中0和1s的比例是否近似预期
• 行程测试:测试给定序列中不同长度的连续相同数字的行程数量是否符合预期
• 一个区块中最长的一次运行:确认一个序列中最长的一次运行是否符合预期

• The Frequency (Monobit) Test: Checks whether the proportion of 0s and 1s in a given sequence are approximately as one would expect
• The Runs Test: Tests whether the number of runs of consecutive identical digits of varying lengths within a given sequence is as expected
• The Longest Run of Ones in a block: Confirms whether the longest single run of ones within a sequence is as would be expected

这将为您很好地指示系统中生成器的随机性.不过请放心，它实际上与真正的随机源几乎没有区别，因此对于几乎任何应用程序，它都应该足够随机.

That would give you a very good indication on how random your generator is on your system. Rest assured, though, that it's likely to be virtually indistinguishable from a truly random source, so it should be sufficiently random for nearly any application.

这篇关于crypto#randomBytes有多随机?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！