814
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Not using a random IV with CBC mode
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-1171]Matthew Green. "Why IND-CPA implies randomized encryption". 2018 August 4. <
https://blog.cryptographyengineering.com/why-ind-cpa-implies-randomized-encryption/ >.
[REF-1172]NIST. "Recommendation for Block Cipher Modes of Operation". 2001 December. <
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf >.2023-04-07.
CWE-330: Use of Insufficiently Random Values
Weakness ID : 330
Structure : Simple
Abstraction : Class
Description
The product uses insufficiently random numbers or values in a security context that depends on
unpredictable numbers.
Extended Description
When product generates predictable values in a context requiring unpredictability, it may be
possible for an attacker to guess the next value that will be generated, and use this guess to
impersonate another user or access sensitive information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ParentOf 331 Insufficient Entropy 821
ParentOf 334 Small Space of Random Values 827
ParentOf 335 Incorrect Usage of Seeds in Pseudo-Random Number
Generator (PRNG)