Skip to content

Commit cabf535

Browse files
committed
No longer provide a default random fallback (was bcrypt-isaac), fixes #16
1 parent 548e86c commit cabf535

11 files changed

Lines changed: 64 additions & 1591 deletions

File tree

README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,9 @@ var bcrypt = require('bcryptjs');
3838

3939
### Browser
4040

41-
In the browser, bcrypt.js by default relies on [Web Crypto API](http://www.w3.org/TR/WebCryptoAPI)'s getRandomValues
42-
interface to obtain secure random numbers. bcrypt-isaac.js additionally ships with the ISAACs PRNG used as the default
43-
fallback if the former is not available. See [bcrypt.setRandomFallback](https://github.com/dcodeIO/bcrypt.js#setrandomfallbackrandom)
44-
to set a custom fallback.
41+
In the browser, bcrypt.js relies on [Web Crypto API](http://www.w3.org/TR/WebCryptoAPI)'s getRandomValues
42+
interface to obtain secure random numbers. If no cryptographically secure source of randomness is available, you may
43+
specify one through [bcrypt.setRandomFallback](https://github.com/dcodeIO/bcrypt.js#setrandomfallbackrandom).
4544

4645
```js
4746
var bcrypt = dcodeIO.bcrypt;
@@ -121,7 +120,8 @@ API
121120
### setRandomFallback(random)
122121

123122
Sets the pseudo random number generator to use as a fallback if neither node's `crypto` module nor the Web Crypto
124-
API is available. Please note: It is highly important that this PRNG is cryptographically secure!
123+
API is available. Please note: It is highly important that the PRNG used is cryptographically secure and that it is
124+
seeded properly!
125125

126126
| Parameter | Type | Description
127127
|-----------------|-----------------|---------------

dist/README.md

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,3 @@ option to specify a random fallback for browser environments that do not support
1313

1414
* **[bcrypt.min.js](https://github.com/dcodeIO/bcrypt.js/blob/master/dist/bcrypt.min.js)**
1515
has been compiled with Closure Compiler using advanced optimizations.
16-
17-
The standard version, which is slightly smaller, is recommended if you are already using a Web Crypto API polyfill or
18-
intend to not support anything else / intend to use a custom random fallback.
19-
20-
### Including ISAAC PRNG as default random fallback
21-
22-
The Web Crypto API is fairly new and not supported by all / older browsers. For maximum compatibility this version
23-
includes [isaac.js](https://github.com/rubycon/isaac.js), a JavaScript implementation of the ISAAC CSPRNG, in conjunction
24-
with an [entropy accumulator](https://github.com/dcodeIO/bcrypt.js/blob/master/src/bcrypt/prng/accum.js) for initial
25-
seeding, which are then used as the default random fallback if neither node's crypto module nor the Web Crypto API is
26-
available.
27-
28-
**See also:** [fallback random number generators considered insecure](https://github.com/dcodeIO/bcrypt.js/issues/16)
29-
30-
* **[bcrypt-isaac.js](https://github.com/dcodeIO/bcrypt.js/blob/master/dist/bcrypt-isaac.js)**
31-
contains the commented source code.
32-
33-
* **[bcrypt-isaac.min.js](https://github.com/dcodeIO/bcrypt.js/blob/master/dist/bcrypt-isaac.min.js)**
34-
has been compiled with Closure Compiler using advanced optimizations.

0 commit comments

Comments
 (0)