Math.random() algorithm

[Johannes Baagoe]

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."

This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.

Does anyone have information about the Math.random() function in various
implementations ?

More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, in Littré, art. PÉDANT)

[Bart Van der Donck]

Johannes Baagoe wrote:

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."

This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.

Does anyone have information about the Math.random() function in various
implementations ?

http://www.merlyn.demon.co.uk/js-randm.htm should keep you busy for a
while.

More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

var unique_url = 'file.php?' + (new Date()).getTime ();

Hope this helps,

--
Bart

[Johannes Baagoe]

Bart Van der Donck :

Johannes Baagoe :

>Does anyone have information about the Math.random() function in various
implementation s?

http://www.merlyn.demon.co.uk/js-randm.htm should keep you busy for a
while.

About half an hour, since the interesting stuff appears to be off-line.

But if the parallel with Borland Pascal/Delphi is valid, the algorithm
would be good old linear congruential Ã* la Lehmer, which is both a bit
surprising for floating point random functions and certainly not good
enough especially when seeded with something as predictable as time.

>More generally, is there any reliable way of picking up good noise,
except by setting up a server and calling it, say, with XMLHTTRequest?

var unique_url = 'file.php?' + (new Date()).getTime ();

That most certainly does not qualify as *good* noise, sorry...

http://www.random.org/integers/?num=...col=16&base=16
is more in line with what I want.

Hope this helps

It did, to a certain extent: ascertaining a negative is always useful.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)

[Erwin Moller]

Johannes Baagoe wrote:

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."

This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.

Does anyone have information about the Math.random() function in various
implementations ?

More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

Hi Johannes,

Personally I WOULD go serverside if the 'quality' of the random numbers
is important for your current task.
You didn't tell us why you need 256 bits of entropy, but if you use
javascript you will stay OS/Browser dependent.
So you're stuck with finding out which OS/browser combi does what. Quite
a job.
Unless you find a nice trustworthy webpage that sums it all up. (I did a
quick search but could find one.)

I think you are probably better of using a good random package on the
server.
In case you need 1000 numbers, just let the server generate 1000 good
random numbers.
And get them in with a XMLHTTRequest.
Why do you want to avoid that solution (you gave yourself already)?

Or even use REAL random bytes, generated by nuclear radiation.
eg: http://www.fourmilab.ch/hotbits/how3.html

Not sure this helped. ;-)
Good luck.

Regards,
Erwin Moller

[Dr J R Stockton]

In comp.lang.javas cript message <GK************ *********@gigan ews.com>,
Tue, 4 Sep 2007 09:08:49, Johannes Baagoe <ba****@baagoe. orgposted:

>About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."

This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.

If you mean by 256 bits what I think you mean : ISO/IEC 16262 permits it
but does not require it. The chance of Math.random providing it (before
PCs have 256-bit integers) is IMHO negligible. It will not, likewise,
be crypto-grade.

>Does anyone have information about the Math.random() function in various
implementation s?

IE6 & IE7 appear to have 53 or more bits of randomness; FF 2.0.0.3 52
bits; Opera 9.21 31 bits. But think about the method used to test that.

One browser is reliably reported to have given 1.0 about once per 30000
calls to Math.random(). That suggests a 15- or 16-bit implementation,
with a bug.

The important questions are probably : what speed of generation do you
need, and have you access to Knuth's books.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v6.05 MIME.
<URL:http://www.merlyn.demo n.co.uk/TP/BP/Delphi/&c., FAQqy topics & links;
<URL:http://www.merlyn.demo n.co.uk/clpb-faq.txt RAH Prins : c.l.p.b mFAQ;
<URL:ftp://garbo.uwasa.fi/pc/link/tsfaqp.zipTimo Salmi's Turbo Pascal FAQ.

[Dr J R Stockton]

In comp.lang.javas cript message <11************ *********@57g20 00hsv.goog
legroups.com>, Tue, 4 Sep 2007 07:15:09, Bart Van der Donck
<ba**@nijlen.co mposted:

>

>More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

var unique_url = 'file.php?' + (new Date()).getTime ();

Round here, the UTC time is strictly monotonic.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v6.05 IE 6.
Web <URL:http://www.merlyn.demo n.co.uk/- w. FAQish topics, links, acronyms
PAS EXE etc : <URL:http://www.merlyn.demo n.co.uk/programs/- see 00index.htm
Dates - miscdate.htm moredate.htm js-dates.htm pas-time.htm critdate.htm etc.

[Randy Webb]

Johannes Baagoe said the following on 9/4/2007 9:27 PM:

Dr J R Stockton :

>If you mean by 256 bits what I think you mean : ISO/IEC 16262 permits it
but does not require it.

If anybody Out There has had the same idea of attempting to provide unique
ids for absolutely anything that one might ever want to identify, I would
certainly join efforts rather than reinvent the wheel, but I am not aware
of anybody else being quite that crazy :-)

It happens every day with Bar Codes :)

The only way to ensure that an ID is not duplicated (in your scenario)
is to keep track of the ones assigned and not re-assign them.

>One browser is reliably reported to have given 1.0 about once per 30000
calls to Math.random(). That suggests a 15- or 16-bit implementation,
with a bug.

Ouch! Which browser is that? It would mean that there would be a fair
chance of duplicates with only a few hundred elements.

Opera 6 would return 1.0 occasionally.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Johannes Baagoe]

Randy Webb :

The only way to ensure that an ID is not duplicated (in your scenario)
is to keep track of the ones assigned and not re-assign them.

Of course, but that means a global repository somewhere, with someone to
maintain it, control it and possibly charge outrageous rates once people
get hooked on the scheme. Sufficiently large random numbers mean that
anybody can make her own with a quite negligible probability of anybody
else ever picking the same.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)

[Randy Webb]

Johannes Baagoe said the following on 9/4/2007 10:01 PM:

Randy Webb :

>The only way to ensure that an ID is not duplicated (in your scenario)
is to keep track of the ones assigned and not re-assign them.

Of course, but that means a global repository somewhere, with someone to
maintain it, control it and possibly charge outrageous rates once people
get hooked on the scheme. Sufficiently large random numbers mean that
anybody can make her own with a quite negligible probability of anybody
else ever picking the same.

Simply generate a 16 digit number by picking 16 random numbers from 0-9
using Math.random() and be done with it. Don't make it any harder or
more difficult than it has to be :)

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Johannes Baagoe]

Randy Webb :

Simply generate a 16 digit number by picking 16 random numbers from 0-9
using Math.random() and be done with it.

Is there a good reason to believe that anybody who does that will always
come up with a different number from anybody else? Or nearly always, the
probability of exceptions being demonstrably so small that you would trust
a system which relies on your solution to operate, e.g., a nuclear plant?

My main contract just now is not quite as critical as that. However, it
concerns a hospital for children with quite severe diseases, and if,
say, a prescription goes to the wrong patient, someone could die.

Don't make it any harder or more difficult than it has to be

I quite agree that solutions should be as simple as possible to do the
job. But no simpler...

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)