JS md5 password autogenerator

[nickhilliard]

Do standard JS implementations have a good enough RNG to be able to create useful BGP MD5 passwords? (INEX ticket [QIG-18162-453])

[barryo]

The function is:

function randomString( length ) {
    var result = '';
    var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    for (var i = length; i > 0; --i) result += chars[Math.round(Math.random() * (chars.length - 1))];
    return result;
}

The built-in JavaScript Math.random() function is not a cryptographic-grade random number generator. That is not to say that I consider this implementation to be a security issue.

A solution is now available for most platforms: crypto.getRandomValues()

Using this, we can only allow random generation of the MD5 if that object is available.