832
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER PRNG Seed Error
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
Weakness ID : 336
Structure : Simple
Abstraction : Variant
Description
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is
initialized.
Extended Description
Given the deterministic nature of PRNGs, using the same seed for each initialization will lead to the
same output in the same order. If an attacker can guess (or knows) the seed, then the attacker may
be able to determine the random numbers that will be produced from the PRNG.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 335 Incorrect Usage of Seeds in Pseudo-Random Number
Generator (PRNG)