829
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Use non-predictable inputs for seed generation.
Phase: Architecture and Design
Phase: Requirements
Strategy = Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy
problems, or use the more recent FIPS 140-3 [REF-1192] if possible.
Phase: Implementation
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as
hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy
source might block.
Demonstrative Examples
Example 1:
Both of these examples use a statistical PRNG seeded with the current value of the system clock to
generate a random number:
Example Language: Java (Bad)
Random random = new Random(System.currentTimeMillis());
CWE Version 4.14
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)