According to caniuse, Google Chrome has support for crypto.getRandomValues() for (presumably/hopefully) generating cryptographically secure random values. How is this implemented?

As there have been many issues with popular crypto libraries using their own homebrew RNGs, I'd like to know how much trust I can grant to this CSPRG.


On POSIX, Google Chrome does in fact use /dev/urandom:

class URandomFd {
        URandomFd() : fd_(open("/dev/urandom", O_RDONLY)) {
            DCHECK_GE(fd_, 0) << "Cannot open /dev/urandom: " << errno;

    ~URandomFd() { close(fd_); }

    int fd() const { return fd_; }

        const int fd_;

// ...

void RandBytes(void* output, size_t output_length) {
    const int urandom_fd = g_urandom_fd.Pointer()->fd();
    const bool success =
        ReadFromFD(urandom_fd, static_cast<char*>(output), output_length);
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.