Generating Passwords with a Secure PRNG

Question

What's the best way to approach generating a password using a secure prng? In Python, I could simply use os.urandom. Any suggestions on this?

 _ = require('underscore')

exports.gen = (n=10) ->
  throw new Error 'Not a number!' if typeof(n) isnt 'number'
  throw new Error 'Prefered (n): [10..128]' if n < 10 or n > 128
  chars = (String.fromCharCode(i) for i in [33..126]).join ''
  _.times(n, -> chars[(Math.random() * chars.length) | 0]).join ''

Answer 1

The equivalent to os.urandom is found in the crypto module: crypto.randomBytes. That module also contains most other functions you might want for password hashing etc.

To use the same password character set as your current code, you could do

exports.gen = (length = 10) ->
  throw new Error 'Length is not a number!' if typeof length isnt 'number'
  throw new Error 'Length must be [10..128]' unless 10 <= length <= 128

  range = 126 - 33
  buffer = require('crypto').randomBytes length # note: may throw an error

  (String.fromCharCode(33 + (range * c / 255) | 0) for c in buffer).join ''

I've changed a few small things

• length instead of n
• Slightly more descriptive error messages, i.e. what is not a number, and sterner wording for bad length values ("prefered" [sic] makes it sound as though it's just a suggestion, but it's actually a requirement)
• CoffeeScript has chained comparisons like Python, so 10 <= length <= 128 can be used