Math.random() algorithm

[Johannes Baagoe]

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."

This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.

Does anyone have information about the Math.random() function in various
implementations ?

More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, in Littré, art. PÉDANT)

[Bart Van der Donck]

Re: Math.random() algorithm

Johannes Baagoe wrote:

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."
>
This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.
>
Does anyone have information about the Math.random() function in various
implementations ?

http://www.merlyn.demon.co.uk/js-randm.htm should keep you busy for a
while.

More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?

var unique_url = 'file.php?' + (new Date()).getTime ();

Hope this helps,

--
Bart

[Johannes Baagoe]

Re: Math.random() algorithm

Bart Van der Donck :

Johannes Baagoe :

>Does anyone have information about the Math.random() function in various
>implementation s?

http://www.merlyn.demon.co.uk/js-randm.htm should keep you busy for a
while.

About half an hour, since the interesting stuff appears to be off-line.

But if the parallel with Borland Pascal/Delphi is valid, the algorithm
would be good old linear congruential à la Lehmer, which is both a bit
surprising for floating point random functions and certainly not good
enough especially when seeded with something as predictable as time.

>More generally, is there any reliable way of picking up good noise,
>except by setting up a server and calling it, say, with XMLHTTRequest?

var unique_url = 'file.php?' + (new Date()).getTime ();

That most certainly does not qualify as *good* noise, sorry...

http://www.random.org/integers/?num=12&min=0&max=16777215&col=16&base=16

is more in line with what I want.

Hope this helps

It did, to a certain extent: ascertaining a negative is always useful.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)

[Erwin Moller]

Re: Math.random() algorithm

Johannes Baagoe wrote:

About Math.random(), ECMA 262 just says "Returns a number value with
positive sign, greater than or equal to 0 but less than 1, chosen randomly
or pseudo randomly with approximately uniform distribution over that
range, using an implementation-dependent algorithm or strategy."
>
This is not good enough for my purposes (to generate identifiers with
sufficient entropy, say 256 bits or so, to effectively preclude any chance
of any two calls ever pricking the same), but it may be a starting point.
>
Does anyone have information about the Math.random() function in various
implementations ?
>
More generally, is there any reliable way of picking up good noise, except
by setting up a server and calling it, say, with XMLHTTRequest?
>

Hi Johannes,

Personally I WOULD go serverside if the 'quality' of the random numbers
is important for your current task.
You didn't tell us why you need 256 bits of entropy, but if you use
javascript you will stay OS/Browser dependent.
So you're stuck with finding out which OS/browser combi does what. Quite
a job.
Unless you find a nice trustworthy webpage that sums it all up. (I did a
quick search but could find one.)

I think you are probably better of using a good random package on the
server.
In case you need 1000 numbers, just let the server generate 1000 good
random numbers.
And get them in with a XMLHTTRequest.
Why do you want to avoid that solution (you gave yourself already)?

Or even use REAL random bytes, generated by nuclear radiation.
eg: http://www.fourmilab.ch/hotbits/how3.html

Not sure this helped. ;-)
Good luck.

Regards,
Erwin Moller

[Dr J R Stockton]

Re: Math.random() algorithm

In comp.lang.javas cript message <GKidnd1R-6ts-0DbRVnyhQA@giga news.com>,
Tue, 4 Sep 2007 09:08:49, Johannes Baagoe <baagoe@baagoe. orgposted:

>About Math.random(), ECMA 262 just says "Returns a number value with
>positive sign, greater than or equal to 0 but less than 1, chosen randomly
>or pseudo randomly with approximately uniform distribution over that
>range, using an implementation-dependent algorithm or strategy."
>
>This is not good enough for my purposes (to generate identifiers with
>sufficient entropy, say 256 bits or so, to effectively preclude any chance
>of any two calls ever pricking the same), but it may be a starting point.

If you mean by 256 bits what I think you mean : ISO/IEC 16262 permits it
but does not require it. The chance of Math.random providing it (before
PCs have 256-bit integers) is IMHO negligible. It will not, likewise,
be crypto-grade.

>Does anyone have information about the Math.random() function in various
>implementation s?

IE6 & IE7 appear to have 53 or more bits of randomness; FF 2.0.0.3 52
bits; Opera 9.21 31 bits. But think about the method used to test that.

One browser is reliably reported to have given 1.0 about once per 30000
calls to Math.random(). That suggests a 15- or 16-bit implementation,
with a bug.

The important questions are probably : what speed of generation do you
need, and have you access to Knuth's books.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v6.05 MIME.
<URL:http://www.merlyn.demo n.co.uk/TP/BP/Delphi/&c., FAQqy topics & links;
<URL:http://www.merlyn.demo n.co.uk/clpb-faq.txt RAH Prins : c.l.p.b mFAQ;
<URL:ftp://garbo.uwasa.fi/pc/link/tsfaqp.zipTimo Salmi's Turbo Pascal FAQ.

[Dr J R Stockton]

Re: Math.random() algorithm

In comp.lang.javas cript message <1188915309.785 145.71840@57g20 00hsv.goog
legroups.com>, Tue, 4 Sep 2007 07:15:09, Bart Van der Donck
<bart@nijlen.co mposted:

>

>More generally, is there any reliable way of picking up good noise, except
>by setting up a server and calling it, say, with XMLHTTRequest?

>
var unique_url = 'file.php?' + (new Date()).getTime ();

Round here, the UTC time is strictly monotonic.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v6.05 IE 6.
Web <URL:http://www.merlyn.demo n.co.uk/- w. FAQish topics, links, acronyms
PAS EXE etc : <URL:http://www.merlyn.demo n.co.uk/programs/- see 00index.htm
Dates - miscdate.htm moredate.htm js-dates.htm pas-time.htm critdate.htm etc.

[Randy Webb]

Re: Math.random() algorithm

Johannes Baagoe said the following on 9/4/2007 9:27 PM:

Dr J R Stockton :
>

>If you mean by 256 bits what I think you mean : ISO/IEC 16262 permits it
>but does not require it.

>
If anybody Out There has had the same idea of attempting to provide unique
ids for absolutely anything that one might ever want to identify, I would
certainly join efforts rather than reinvent the wheel, but I am not aware
of anybody else being quite that crazy :-)

It happens every day with Bar Codes :)

The only way to ensure that an ID is not duplicated (in your scenario)
is to keep track of the ones assigned and not re-assign them.

>One browser is reliably reported to have given 1.0 about once per 30000
>calls to Math.random(). That suggests a 15- or 16-bit implementation,
>with a bug.

>
Ouch! Which browser is that? It would mean that there would be a fair
chance of duplicates with only a few hundred elements.

Opera 6 would return 1.0 occasionally.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Johannes Baagoe]

Re: Math.random() algorithm

Randy Webb :

The only way to ensure that an ID is not duplicated (in your scenario)
is to keep track of the ones assigned and not re-assign them.

Of course, but that means a global repository somewhere, with someone to
maintain it, control it and possibly charge outrageous rates once people
get hooked on the scheme. Sufficiently large random numbers mean that
anybody can make her own with a quite negligible probability of anybody
else ever picking the same.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)

[Randy Webb]

Re: Math.random() algorithm

Johannes Baagoe said the following on 9/4/2007 10:01 PM:

Randy Webb :
>

>The only way to ensure that an ID is not duplicated (in your scenario)
>is to keep track of the ones assigned and not re-assign them.

>
Of course, but that means a global repository somewhere, with someone to
maintain it, control it and possibly charge outrageous rates once people
get hooked on the scheme. Sufficiently large random numbers mean that
anybody can make her own with a quite negligible probability of anybody
else ever picking the same.

Simply generate a 16 digit number by picking 16 random numbers from 0-9
using Math.random() and be done with it. Don't make it any harder or
more difficult than it has to be :)

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Johannes Baagoe]

Re: Math.random() algorithm

Randy Webb :

Simply generate a 16 digit number by picking 16 random numbers from 0-9
using Math.random() and be done with it.

Is there a good reason to believe that anybody who does that will always
come up with a different number from anybody else? Or nearly always, the
probability of exceptions being demonstrably so small that you would trust
a system which relies on your solution to operate, e.g., a nuclear plant?

My main contract just now is not quite as critical as that. However, it
concerns a hospital for children with quite severe diseases, and if,
say, a prescription goes to the wrong patient, someone could die.

Don't make it any harder or more difficult than it has to be

I quite agree that solutions should be as simple as possible to do the
job. But no simpler...

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, cité dans le Littré, art. PÉDANT)

[Randy Webb]

Re: Math.random() algorithm

Johannes Baagoe said the following on 9/5/2007 12:14 AM:

Randy Webb :
>

>Simply generate a 16 digit number by picking 16 random numbers from 0-9
>using Math.random() and be done with it.

>
Is there a good reason to believe that anybody who does that will always
come up with a different number from anybody else? Or nearly always, the
probability of exceptions being demonstrably so small that you would trust
a system which relies on your solution to operate, e.g., a nuclear plant?
>
My main contract just now is not quite as critical as that. However, it
concerns a hospital for children with quite severe diseases, and if,
say, a prescription goes to the wrong patient, someone could die.

If what you are doing is that critical, then you have to do it on the
server and remove any - and all - chance of the possibility of a
duplicate. To not do that introduces the off chance of a duplicate
accourring. For what you are doing you need a serial number(as I
suggested earlier). You could start with patient # 000001 and increment
it each time and have no need at all for a random number. Simply keep
track on the server of the last patient number and increment it.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Erwin Moller]

Re: Math.random() algorithm

Johannes Baagoe wrote:

Randy Webb :
>

>Simply generate a 16 digit number by picking 16 random numbers from 0-9
>using Math.random() and be done with it.

>
Is there a good reason to believe that anybody who does that will always
come up with a different number from anybody else? Or nearly always, the
probability of exceptions being demonstrably so small that you would trust
a system which relies on your solution to operate, e.g., a nuclear plant?
>
My main contract just now is not quite as critical as that. However, it
concerns a hospital for children with quite severe diseases, and if,
say, a prescription goes to the wrong patient, someone could die.
>

>Don't make it any harder or more difficult than it has to be

>
I quite agree that solutions should be as simple as possible to do the
job. But no simpler...
>

Hi Johannes,

I think that such a applications asks for one central database that is
responsible for giving (generating) unique ids.
Forget Math.random(), and just go serverside to 1 (big) database.
Why work with messy solutions if you can ensure a SERIAL field in the
database will garantuee you unique identifiers?
I expect you'll have to set up a database anyway if you want to keep
track of the prescriptions.

just my 2 cent...

Regards,
Erwin Moller

[Thomas 'PointedEars' Lahn]

Re: Math.random() algorithm

T. Postel wrote:

http://en.wikipedia.org/wiki/Uuid

Available in many languages, JavaScript included, and even a mySQL
implementation.

Apart from the fact that they are not providing a class but a prototype,
as the client-side JS that they support has no classes.


PointedEars
--
realism: HTML 4.01 Strict
evangelism: XHTML 1.0 Strict
madness: XHTML 1.1 as application/xhtml+xml
-- Bjoern Hoehrmann

[Johannes Baagoe]

Re: Math.random() algorithm

Randy Webb :

What the OP wants/needs is uniquely identifying numbers to identify
patients.

That is just a special case. What I want is UUIDs, preferably generated
client-side Javascript. Except that I did not know anything about UUIDs
before T. Postel provided a link, so I did not know that that was what I
wanted.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pédant" (H. Estienne, in É. Littré, /Dictionnaire de la
langue française/, art. PÉDANT)

[Dr J R Stockton]

Re: Math.random() algorithm

In comp.lang.javas cript message <0fOdnWo_n92zsE PbnZ2dnUVZ8sXin Z2d@gigane
ws.com>, Tue, 4 Sep 2007 23:14:38, Johannes Baagoe <baagoe@baagoe. org>
posted:

>Randy Webb :
>

>Simply generate a 16 digit number by picking 16 random numbers from 0-9
>using Math.random() and be done with it.

>
>Is there a good reason to believe that anybody who does that will always
>come up with a different number from anybody else? Or nearly always, the
>probability of exceptions being demonstrably so small that you would trust
>a system which relies on your solution to operate, e.g., a nuclear plant?

There is good reason to disbelieve it, at least in the case of those
using javascript browsers.

Since MS IE is so common, there's a fair chance that any given pair of
users are both using it, and therefore will traverse the same sequence
from wherever they start. We do not know how it is initialised, but
it's likely to be from the time-of-day or the time-since-boot. The
chances of one pair of the many(?) users getting, once, the same
initialisation are not IMHO negligible. But greater knowledge of the
internals may rule that out.


But here's a thought, not to be taken too seriously - ask the patient to
type in a unique 64-digit number. Ignore the choice of digits, but time
the intervals between them. Each interval, mod 4, should give 2 bits of
near-randomness.


Once Upon A Time, I was friendly with the staff of a computer centre. I
heard that they'd written a business game, to be played each day one
week and scheduled to start at 09:00. I remarked that there was a
chance, with the RNG seeded by the time, that the same random sequence
would be used each day, and seen to be so. While it was agreed that the
chances of that were small, their professionalism caused them to dash
off to exclude the possibility.

--
(c) John Stockton, Surrey, UK. *@merlyn.demon. co.uk / ??.Stockton@phy sics.org
Web <URL:http://www.merlyn.demo n.co.uk/- FAQish topics, acronyms, & links.
Correct <= 4-line sig. separator as above, a line precisely "-- " (SoRFC1036)
Do not Mail News to me. Before a reply, quote with ">" or "" (SoRFC1036)