cryptographicallySecureSalts property
Controls if non-cryptographically secure random salts are allowed.
If no salt value is provided to Crypt.sha256 and Crypt.sha512, a salt is randomly generated. This member controls whether the random number generator can be non-cryptographically secure or not.
If a cryptographically secure random number generator is available, it will always be used. This library will never uses a non-cryptographic secure one, if a cryptographically secure one is available. This member controls what happens if a cryptographically secure random number generator is not available: whether to allow fall back to a non-cryptographically secure random number generator or to fail.
If set to false, it will fall back to using a non-cryptographically secure random number generator. This is less secure, but it will always be able to generate random salts---no matter what platform it is running on.
If set to true, it will never fall back to using a non-cryptographically secure random number generator. If a cryptographically secure random number generator is not available, those constructors will throw an UnsupportedError exception. This is more secure, but the will not work on all platforms.
This member only has effect on subsequently generated salts. Therefore, it should be set before generating salts.
Recommendation: Explicitly set the value instead of relying on the default value.
The default is currently false, for backward compatibility with version 4.0.1 and earlier. Those versions always used a non-cryptographically secure random number generator.
A future release may make a breaking change by setting the default to true. That will ensure better security by default, and programs that allow weaker salts must explicitly indicate that. On platforms without a cryptographically secure random number generator, that will cause programs that previously worked to fail. To prepare for that change, programs should explicitly set this to false, if it is acceptable to use a non-cryptographically secure random number generator to generate salts. That will ensure those program continue to work when the default is changed. The change will have no effect on platforms that have cryptographic secure random number generators.
Implementation
static bool cryptographicallySecureSalts = false;