I need some viable sources for entropy to seed a CSPRNG. So far, I have:
- JS Events
- Web Crypto API
- Timing for xmlHTTPRequests
Fortunately, you don't have to choose. The xor function has the property that if you xor multiple independent source of entropy streams, the resulting output stream is going to have at least the entropy of the stronger source.
Web Crypto CSPRNG (Crypto.getRandomValues()) is all you will need to generate crypto keys. But if you for some reason don't trust the smart people who wrote your browser, you can just xor together the output of Web Crypto with other entropy sources of your choice, say request some random bits from random.org, the URL of some random advertising network, etc. Just mix them all together, it won't harm the entropy level.