window.crypto.getRandomValues() 的兼容性

Question

I need to generate cryptographically secure pseudorandom numbers, in Javascript. I know about the window.crypto.getRandomValues API, which does exactly what I want. However, I also know it was introduced relatively recently (in 2011 or so).

Can I safely assume window.crypto.getRandomValues is present, or will using it introduce compatibility problems on some browsers? Are there any major (widely used) browsers which do not support window.crypto.getRandomValues (including mobile or desktop browsers), and if so, which ones do I need to worry about? I would be delighted to learn that there is enough support that I no longer need to worry about fallback methods , if that is indeed the case.

Answer 1

Can I safely assume window.crypto.getRandomValues is present

As always it depends on your target market and will change over time. caniuse.com lists which browsers support it and calculates the browser marketshare.

Here is a summary:

• IE 11: w/ prefix

• IE Mobile 11: w/ prefix

• Firefox: 21+

• Firefox Mobile: 21+

• Safari: from 6.1

• Safari Mobile: 7.1

• Chrome: 11+

• Chrome for Mobile: 23+

• Android browser: 4.4

• Opera: 15+

• Opera Mobile: 36+
• Opera Mini: no

Answer 2

For a more complete, up-to-date view, it's probably better to just check caniuse.com :

http://caniuse.com/#feat=getrandomvalues

As of December 2015, all modern browsers, except for Opera Mini, support it:

Answer 3

const crypto = window.crypto ||
  window.msCrypto || {
    getRandomValues: array => {
      for (let i = 0, l = array.length; i < l; i++) {
        array[i] = Math.floor(Math.random() * 256);
      }
      return array;
    }
  };

  if (crypto.getRandomValues === undefined) {
    throw new Error("crypto is not supported on this browser");
  }

Answer 4

Opera is the only one that does not support window.crypto.getRandomValues, but it's math.random() is pretty secure.

What I did to solve this was just to check if the window.crypto is available, if not check is it an opera browser and if not just throw an error saying that the browser can't generate a secure password.

if(window.crypto && window.crypto.getRandomValues)
{
    (use window.crypto.getRandomValues)
}
else if(isOpera)
{
    (use Math.random)
}
else throw new Error("Your browser can not generate a secure Password, please change it to one that can (Google Chrome, IE, Firefox, Safari, Opera) or get the newest update.");