CRYPTOGRAPHIC PASSWORD ENTROPY & CSPRNG ARCHITECTURE
TACTICAL CIPHER SPECIFICATION // SHANNON ENTROPY & HARDWARE RANDOMNESS
Why Math.random() is Insecure
Standard pseudo-random number generators (PRNGs) like JavaScript's Math.random() are typically implemented using the xoshiro128+ algorithm. They are completely deterministic and cryptographically broken: an attacker who observes a small sequence of generated outputs can reconstruct internal states and predict future values.
Cipher Vault uses window.crypto.getRandomValues(), which interfaces directly with underlying operating system entropy pools (/dev/urandom on Linux/macOS or CryptGenRandom / BCryptGenRandom on Windows) fed by CPU thermal noise, hardware timing jitter, and hardware RNG circuits (RDRAND/RDSEED).
Calculating Shannon Bitwise Entropy
Password security is measured in bits of entropy using the formula:
E = L × log2(R)
where L represents password length and R represents character pool size (e.g. 26 lowercase + 26 uppercase + 10 numbers + 32 symbols = 94 pool size).
A 24-character password generated across a 94-character pool yields 157.3 bits of entropy. Exhausting this keyspace would require testing $2^{157}$ combinations, rendering brute-force attacks physically impossible even against hypothetical planetary quantum supercomputers.