Generating a secure random number in javascript What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use.

My approach is the following:


I am creating a Uint8Array with the desired length.
I am using Math.random() to prefill it.
I am showing a a 256x256pixel box, and show a message asking for moving the mouse around in it. For every onmousemove event, I am selecting a random byte in the array (using Math.random again), and doing a bitwise XOR with the relative X position of the mouse cursor, and doing the same to another random byte, with the Y position.
I keep processing onmousemove events until N events have been processed. (N >= a lot)


So what I have in the end is an array that was prefilled by an insecure random number generator, but whose output was mixed around with a lot of user-generated entropy.

My question is: Would the resulting number be safe to use? Or am I missing some glaring insecurity in this approach?
I would take a look at https://github.com/mdp/gibberish-aes/ From that you can see well implemented ECMAscript, (javascript) and AES can be used to generate random numbers. It might be slightly over-kill for your needs, but should not let you down in the medium-term.