823
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insufficient Entropy
WASC 11 Brute Force
CERT C Secure Coding MSC32-
C
Exact Properly seed pseudorandom number
generators
Related Attack Patterns
CAPEC-ID Attack Pattern Name
59 Session Credential Falsification through Prediction
References
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
CWE-332: Insufficient Entropy in PRNG
Weakness ID : 332
Structure : Simple
Abstraction : Variant
Description
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can
be a stability and security threat.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 331 Insufficient Entropy 821
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
CWE Version 4.14
CWE-332: Insufficient Entropy in PRNG
CWE-332: Insufficient Entropy in PRNG