3 files changed, 14 insertions, 5 deletions
diff --git a/base/rand_util.h b/base/rand_util.h
index c5c4ef8..4f4765b 100644
--- a/base/rand_util.h
+++ b/base/rand_util.h
@@ -32,14 +32,21 @@ BASE_EXPORT double RandDouble();
 // the range [0, 1). Thread-safe.
 BASE_EXPORT double BitsToOpenEndedUnitInterval(uint64 bits);
 
-// Fills |output_length| bytes of |output| with cryptographically strong random
-// data.
+// Fills |output_length| bytes of |output| with random data.
+//
+// WARNING:
+// Do not use for security-sensitive purposes.
+// See crypto/ for cryptographically secure random number generation APIs.
 BASE_EXPORT void RandBytes(void* output, size_t output_length);
 
-// Fills a string of length |length| with with cryptographically strong random
-// data and returns it.  |length| should be nonzero.
+// Fills a string of length |length| with with random data and returns it.
+// |length| should be nonzero.
 //
 // Note that this is a variation of |RandBytes| with a different return type.
+//
+// WARNING:
+// Do not use for security-sensitive purposes.
+// See crypto/ for cryptographically secure random number generation APIs.
 BASE_EXPORT std::string RandBytesAsString(size_t length);
 
 #ifdef OS_POSIX
diff --git a/base/rand_util_posix.cc b/base/rand_util_posix.cc
index abb404a..d65ddae 100644
--- a/base/rand_util_posix.cc
+++ b/base/rand_util_posix.cc
@@ -41,6 +41,7 @@ base::LazyInstance<URandomFd> g_urandom_fd = LAZY_INSTANCE_INITIALIZER;
 
 namespace base {
 
+// NOTE: This function must be cryptographically secure. http://crbug.com/140076
 uint64 RandUint64() {
   uint64 number;
 
diff --git a/base/rand_util_win.cc b/base/rand_util_win.cc
index ec0411e..391fe5b 100644
--- a/base/rand_util_win.cc
+++ b/base/rand_util_win.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -21,6 +21,7 @@ uint32 RandUint32() {
 
 namespace base {
 
+// NOTE: This function must be cryptographically secure. http://crbug.com/140076
 uint64 RandUint64() {
   uint32 first_half = RandUint32();
   uint32 second_half = RandUint32();