ENTROPY FLUX // CRYPTOGRAPHIC ENTROPY POOLS & UNIFORM DISTRIBUTION
Technical architecture of hardware-backed CSPRNG algorithms, rejection sampling, and non-predictable randomness.
Math.random() vs. Web Crypto CSPRNG
Standard software random functions like JavaScript's native Math.random() use pseudo-random algorithms (such as xoshiro128+ in V8 engine) that are deterministic and vulnerable:
- Predictable Seeds: Given 2 to 3 consecutive outputs of
Math.random(), internal states can be mathematically reconstructed to predict future outputs. - CSPRNG Architecture:
crypto.getRandomValues()taps directly into OS entropy pools (Linux/dev/urandom, Windows CNGBCryptGenRandom, macOSgetentropy), gathering thermal noise, mouse jitter, and CPU interrupts. - Cryptographic Security: Meets FIPS 140-2 standards; essential for cryptographic key generation, authentication salts, and tamper-resistant lotteries.
Eliminating Modulo Bias via Rejection Sampling
Simply computing rand % (max - min + 1) introduces modulo bias when the range does not evenly divide 2³²:
- Rejection Sampling: Numbers falling in the biased tail of the 32-bit integer range are discarded and repolled to guarantee exact mathematical uniformity.
- Sampling Without Replacement: Unique batch generation enforces a rejection set guaranteeing no duplicated elements without distorting individual probability curves.
Airgap Zero-Log Privacy Architecture
All random numbers are generated locally within the active browser execution thread using the hardware security module of your device. No generated tokens, PINs, or seeds are transmitted or stored remotely.