840
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-339: Small Seed Space in PRNG
Weakness ID : 339
Structure : Simple
Abstraction : Variant
Description
A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it
more susceptible to brute force attacks.
Extended Description
PRNGs are entirely deterministic once seeded, so it should be extremely difficult to guess the seed.
If an attacker can collect the outputs of a PRNG and then brute force the seed by trying every
possibility to see which seed matches the observed output, then the attacker will know the output of
any subsequent calls to the PRNG. A small seed space implies that the attacker will have far fewer
possible values to try to exhaust all possibilities.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 335 Incorrect Usage of Seeds in Pseudo-Random Number
Generator (PRNG)