825
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Insufficient entropy in PRNG
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC02-J Generate strong random numbers
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-1374]Unciphered. "Randstorm: You Can't Patch a House of Cards". 2023 November 4. <
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards >.2023-11-15.
CWE-333: Improper Handling of Insufficient Entropy in TRNG
Weakness ID : 333
Structure : Simple
Abstraction : Variant
Description
True random number generators (TRNG) generally have a limited source of entropy and therefore
can fail or block.
Extended Description
The rate at which true random numbers can be generated is limited. It is important that one uses
them only when they are needed for security.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 755 Improper Handling of Exceptional Conditions 1576
ChildOf 331 Insufficient Entropy 821
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-333: Improper Handling of Insufficient Entropy in TRNG
CWE-333: Improper Handling of Insufficient Entropy in TRNG