I've got a requirement to generate a random string...
# suitescriptc
Chris
10/17/2019, 4:45 PMI've got a requirement to generate a random string on a server side script. It has to be crypto secure. This is harder than i thought it would be. Anyone solved this already?
c
creece
10/17/2019, 4:59 PMmaybe check out CryptoJS and use that
b
battk
10/17/2019, 5:16 PMThe basic solution to this is to first define your alphabet, then randomly choose a letter from your alphabet, repeat for each character of your string
s
stalbert
10/17/2019, 7:23 PMI'd recommend against writing anything yourself. Lean on proven/tested implementation, perhaps from CryptoJS as creece suggests, or from something NS provides ( I haven't used their built in crypto api for a while)
c
creece
10/17/2019, 7:25 PMthe built in crypto stuff is lacking
creece
10/17/2019, 7:26 PMthats what i was getting at is dont reinvent the wheel.. random in cs isn't really random and there's all kinds of weirdness around it.. but nothing stopping you from writing some small piece if you absolutely need to reinvent the wheel.
b
battk
10/17/2019, 7:35 PMQuestion is weird in the first place. Random string is weird. Random byte or number is more normal and is something you can get out of cryptojs
s
stalbert
10/17/2019, 7:38 PMaye, though reinventing the wheel in the crypto space is more than just wasting time - it's a security risk as well.
c
creece
10/17/2019, 7:40 PMagreed
c
Chris
10/17/2019, 10:35 PMI'm generating a password for consumption by a third party. Being server side makes it harder because many of the js libs that provide this service rely on browser tools. Hence the awkwardness of the solution.
b
battk
10/18/2019, 1:24 AMthat generally doesn't have to be crypto secure. Generally your password just needs to be resistant to guessing ie. wont be guessed by a computer or human
battk
10/18/2019, 2:09 AMif you really need crypto secure, you are doomed, there is no crypto secure random number generator like crypto.getRandomValues in suitescript and Math.random makes no promises about security
battk
10/18/2019, 2:10 AM.you can try using a webservice that generates random numbers
battk
10/18/2019, 2:12 AMif you are truly desperate, you can try abusing the initialization vector returned by N/crypto's crypto.CipherPayload
4 Views