Page History

...

As a result, after the first run of the PRNG, an attacker can predict the sequence of random numbers that will be generated in the future runs. Improperly seeding or failing to seed the PRNG can lead to many vulnerabilities, especially in security protocols.

...

It is worth noting that not all random number generators can be seeded. True random number generators that rely on hardware to produce completely unpredictable results do not need to be and cannot be seeded. Some high-quality PRNGs, such as the /dev/random device on some UNIX systems, also cannot be seeded. This rule applies only to algorithmic pseudorandom generators that make seeding possiblecan be seeded.

MSC30-C. Do not use the rand() function for generating pseudorandom numbers addresses PRNGs from a different perspective, which is the cycle of the pseudorandom number sequence—that is, during a single run of a PRNG, the time interval after which the PRNG generates the same random numbers. MSC30-C disallows use of the rand() function because it generates numbers that have a comparatively short cycle. The same rule proposes the use of the random() function for POSIX and the CryptGenRandom() function for Windows.

This rule examines, in terms of seeding, all three PRNGs mentioned in rule MSC30-C. Noncompliant code examples correspond to the use of a PRNG without a seed, and compliant solutions correspond to the same PRNG being properly seeded. This rule complies with MSC30-C and does not recommend the use of the rand() function. Nevertheless, if it is unavoidable to use rand(), it should at least be properly seeded.

Noncompliant Code Example

This noncompliant code example generates a sequence of 10 pseudorandom numbers using the rand() function. When rand() is not seeded, it uses 1 as a default seed. No matter how many times this code is executed, it always produces the same sequence.

#include <stdio.h>
#include <stdlib.h>
 
void func(void) {
  for (unsigned int i = 0; i < 10; ++i) {
    /* Always generates the same sequence */ 
    printf("%d, ", rand());
  }
}

...

1st run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,
2nd run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,
...
nth run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,

Noncompliant Code Example

Use srand() before rand() to seed the random sequence generated by rand(). The code produces different random number sequences at different calls.

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
 
void func(void) {
  srand(time(NULL)); /* Create seed based on current time */
  for (unsigned int i = 0; i < 10; ++i) {
    /* Generates different sequences at different runs */
    printf("%d, ", rand());
  }
}

...

Although the rand() function is now properly seeded, this solution is still noncompliant because the numbers generated by rand() have a comparatively short cycle, and the numbers can be predictable. (See MSC30-C. Do not use the rand() function for generating pseudorandom numbers.)

Noncompliant Code Example (POSIX)

This noncompliant code example generates a sequence of 10 pseudorandom numbers using the random() function. When random() is not seeded, it behaves like rand(), producing the same sequence of random numbers at different calls.

#include <stdio.h>
#include <stdlib.h>
 
void func(void) {
  for (unsigned int i = 0; i < 10; ++i) {
    /* Always generates the same sequence */
    printf("%ld, ", random());
  }
}

...

1st run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649,
         1189641421,
2nd run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649,
         1189641421,
...
nth run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649,
         1189641421,

Compliant Solution (POSIX)

Use srandom() before random() to seed the random sequence generated by random(). The code produces different random number sequences at different calls.

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
 
void func(void) {
  /*
   * Create seed based on current time counted as
   * seconds from 01/01/1970.
   */
  srandom(time(NULL));
  for (unsigned int i = 0; i < 10; ++i) {
    /* Generates different sequences at different runs */
    printf("%ld, ", random());
  }
}

...

In the previous examples, seeding in rand() and random() is done using the time() function, which returns the current time calculated as the number of seconds that have passed since January 1, 1970. Depending on the application and the desirable level of security, a programmer may choose alternative ways to seed PRNGs. In general, hardware is more capable than humans of generating real random numbers (for example, by generating a sequence of bits by sampling the thermal noise of a diode and using the result as a seed).

Compliant Solution (Windows)

CryptGenRandom() does not run the risk of not being properly seeded because its arguments serve as seeders.

#include <Windows.h>
#include <wincrypt.h>
#include <stdio.h>
 
void func(void) {
  HCRYPTPROV hCryptProv;
  long rand_buf;
  /* Example of instantiating the CSP */
  if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
    printf("CryptAcquireContext succeeded.\n");
  } else {
    printf("Error during CryptAcquireContext!\n");
  }

  for (unsigned int i = 0; i < 10; ++i) {
    if (!CryptGenRandom(hCryptProv, sizeof(rand_buf), (BYTE *)&rand_buf)) {
      printf("Error\n");
    } else {
      printf("%ld, ", rand_buf);
    }
  }
}

...

1st run: -1597837311, 906130682, -1308031886, 1048837407, -931041900, -658114613, -1709220953, -1019697289, 1802206541,
         406505841,
2nd run: 885904119, -687379556, -1782296854, 1443701916, -624291047, 2049692692, -990451563, -142307804, 1257079211,
         897185104,
3rd run: 190598304, -1537409464, 1594174739, -424401916, -1975153474, 826912927, 1705549595, -1515331215, 474951399,
         1982500583,

Risk Assessment

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...