CRYPTOGRAPHIC CSPRNG ENTROPY, SHANNON INFORMATION & TOKEN SECURITY
Technical specifications for Web Crypto API hardware seeding, Claude Shannon entropy equations, and NIST SP 800-90A guidelines.
1. Math.random() vs Cryptographic CSPRNG
Standard JavaScript Math.random() relies on pseudorandom number generators like xorshift128+ that are completely deterministic and vulnerable to state-recovery attacks. After observing just a few sequential outputs, attackers can reconstruct internal PRNG states and predict future tokens.
This utility strictly utilizes the window.crypto.getRandomValues() API, which pulls entropy directly from host operating system kernels (/dev/urandom on Linux/macOS and BCryptGenRandom on Windows), incorporating hardware interrupt jitter and CPU thermal noise.
2. Information Entropy Calculation (Shannon)
Total cryptographic entropy represents the number of guesses required under a theoretical brute-force exhaustion attack:
A 32-character token generated from a 62-character alphanumeric pool yields 190.5 bits of entropy, rendering brute force computationally impossible across classical computers and quantum search algorithms.
0 vs O, 1 vs l vs I) to prevent transcription mistakes.