820
This can be primary to many other weaknesses such as cryptographic errors, authentication
errors, symlink following, information leaks, and others.
Maintenance
As of CWE 4.3, CWE-330 and its descendants are being investigated by the CWE crypto team
to identify gaps related to randomness and unpredictability, as well as the relationships between
randomness and cryptographic primitives. This "subtree analysis" might result in the addition
or deprecation of existing entries; the reorganization of relationships in some views, e.g. the
research view (CWE-1000); more consistent use of terminology; and/or significant modifications
to related entries.
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Randomness and Predictability
7 Pernicious Kingdoms Insecure Randomness
OWASP Top Ten 2004 A2 CWE More Specific Broken Access Control
CERT C Secure Coding CON33-
C
Imprecise Avoid race conditions when using
library functions
CERT C Secure Coding MSC30-
C
CWE More
Abstract
Do not use the rand() function for
generating pseudorandom numbers
CERT C Secure Coding MSC32-
C
CWE More
Abstract
Properly seed pseudorandom number
generators
WASC 11 Brute Force
WASC 18 Credential/Session Prediction
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC02-J Generate strong random numbers
Related Attack Patterns
CAPEC-ID Attack Pattern Name
59 Session Credential Falsification through Prediction
112 Brute Force
485 Signature Spoofing by Key Recreation
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE Version 4.14
CWE-331: Insufficient Entropy
CWE-331: Insufficient Entropy