837
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Predictable Seed in PRNG
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC02-J Generate strong random numbers
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-1192]Information Technology Laboratory, National Institute of Standards and Technology.
"FIPS PUB 140-3: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2019
March 2. < https://csrc.nist.gov/publications/detail/fips/140/3/final >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator
(PRNG)
Weakness ID : 338
Structure : Simple
Abstraction : Base
Description
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the
PRNG's algorithm is not cryptographically strong.
Extended Description
When a non-cryptographic PRNG is used in a cryptographic context, it can expose the
cryptography to certain types of attacks.
Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a
mediocre source of randomness is sufficient or preferable for algorithms that use random numbers.
Weak generators generally take less processing power and/or do not use the precious, finite,
entropy sources on a system. While such PRNGs might have very useful features, these same
features could be used to break the cryptography.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 330 Use of Insufficiently Random Values 814
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 330 Use of Insufficiently Random Values 814
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-338: Use of Cryptographically Weak
Pseudo-Random Number Generator (PRNG) 838
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1213 Random Number Issues 2477
MemberOf 310 Cryptographic Issues 2318
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
If a PRNG is used for authentication and authorization,
such as a session ID or a seed for generating a
cryptographic key, then an attacker may be able to easily
guess the ID or cryptographic key and gain access to
restricted functionality.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Use functions or hardware which use a hardware-based random number generation for all
crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on
Linux.
Demonstrative Examples
Example 1:
Both of these examples use a statistical PRNG seeded with the current value of the system clock to
generate a random number:
Example Language: Java (Bad)
Random random = new Random(System.currentTimeMillis());
int accountID = random.nextInt();
Example Language: C (Bad)
srand(time());
int randNum = rand();
CWE Version 4.14
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-338: Use of Cryptographically Weak
Pseudo-Random Number Generator (PRNG)