847
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Predictable Exact Value from Previous
Values
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-343: Predictable Value Range from Previous Values
Weakness ID : 343
Structure : Simple
Abstraction : Base
Description
The product's random number generator produces a series of values which, when observed, can
be used to infer a relatively small range of possibilities for the next value that could be generated.
Extended Description
The output of a random number generator should not be predictable based on observations of
previous values. In some cases, an attacker cannot predict the exact value that will be produced
next, but can narrow down the possibilities significantly. This reduces the amount of effort to
perform a brute force attack. For example, suppose the product generates random numbers
between 1 and 100, but it always produces a larger value until it reaches 100. If the generator
produces an 80, then the attacker knows that the next value will be somewhere between 81 and
100. Instead of 100 possibilities, the attacker only needs to consider 20.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-343: Predictable Value Range from Previous Values
CWE-343: Predictable Value Range from Previous Values