848
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 340 Generation of Predictable Numbers or Identifiers 842
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Increase the entropy used to seed a PRNG.
Phase: Architecture and Design
Phase: Requirements
Strategy = Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy
problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as
hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy
source might block.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Predictable Value Range from Previous
Values
References
CWE Version 4.14
CWE-344: Use of Invariant Value in Dynamically Changing Context
CWE-344: Use of Invariant Value in Dynamically Changing Context