Page History

A pseudo-random pseudorandom number generator (PRNG) is a deterministic algorithm capable of generating sequences of numbers that approximate the properties of random numbers. Each sequence is completely determined by the initial state of the PRNG and the algorithm for changing the state. Most PRNGs make it possible to set the initial state, also referred to as also called the " seed state." This is referred to as "seeding"  Setting the initial state is called seeding the PRNG.

Calling a PRNG in the same initial state, either without seeding it explicitly , or by seeding with the same value, results in generating the same sequence of random numbers in different runs of the program.

Suppose an a PRNG function is called 10 times consecutively to produce a sequence of 10 random numbers. Suppose also that this PRNG is not seeded. Running the code for the first time produces the sequence S = <r1, r2, r3, r4, r5, r6, r7, r8, r9, r10>. Running the code a second time produces the exact same produces exactly the same S sequence. Generally, any subsequent runs of the code will generate the same S sequence.

As a result, after the first run of the PRNG, an attacker can predict the sequence of random numbers that will be generated in the future runs. This can  Improperly seeding or failing to seed the PRNG can lead to many vulnerabilities, especially in security protocols.

As a solution, you should always The solution is to always ensure that your PRNG is properly seeded. Seeding a PRNG means that it will generate different sequences of random numbers at any call.

It is worth noting that not all random number generators can be seeded. True random number generators (RNGRNGs) that rely on hardware to produce completely unpredictable results cannot be seeded. Some high-quality pseudo-random pseudorandom generators such as the /dev/random device on some UNIX systems also cannot be seeded. This rule applies to algorithmic pseudo-random pseudorandom generators that make seeding possible.

Rule MSC30-C. Do not use the rand() function for generating pseudorandom numbers addresses PRNGs from a different perspective, which is the cycle of the pseudo-random number sequence. In other words, during pseudorandom number sequence—that is, during a single run of a PRNG, the time interval after which the PRNG generates the same random numbers. The rule MSC30-C deprecates the rand() function because it generates numbers that have a comparatively short cycle. The same rule proposes the use of the random() function for POSIX and CryptGenRandom() function for Windows.

The current rule (MSC32-C) examines, in terms of seeding, all three PRNGs mentioned in rule MSC30-C. Noncompliant code examples correspond to the use of a PRNG without a seed, while compliant solutions correspond to the same PRNG being properly seeded. Rule MSC32-C complies to rule with MSC30-C and does not recommend the use of the rand() function. Nevertheless, if it is unavoidable to use rand(), it should at least be properly seeded.

...

int i=0;
for (i=0; i<10; i++) {
  printf("%d, ", rand()); /* Always generates the same sequence */
}

output:
1st run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,
2nd run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,
...
nth run: 41, 18467, 6334, 26500, 19169, 15724, 11478, 29358, 26962, 24464,

...

srand(time(NULL)); /* Create seed based on current time */
int i=0;
for (i=0; i<10; i++) {
  printf("%d, ", rand()); /* Generates different sequences at different runs */
}

output:
1st run: 25121, 15571, 29839, 2454, 6844, 10186, 27534, 6693, 12456, 5756,
2nd run: 25134, 25796, 2992, 403, 15334, 25893, 7216, 27752, 12966, 13931,
3rd run: 25503, 27950, 22795, 32582, 1233, 10862, 31243, 24650, 11000, 7328,
...

Although the rand() function is now properly seeded, this solution is still noncompliant because the numbers generated by rand() have a comparatively short cycle, and the numbers can be predictable. (See rule MSC30-C. Do not use the rand() function for generating pseudorandom numbers.)

...

This noncompliant code example generates a sequence of 10 pseudorandom numbers using the random() function. When random() is not seeded, it behaves like rand(), thus producing the same sequence of random numbers at different calls.

int i=0;
for (i=0; i<10; i++) {
  printf("%ld, ", random()); /* Always generates the same sequence */
}

output:
1st run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649, 1189641421,
2nd run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649, 1189641421,
...
nth run: 1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335, 719885386, 1649760492, 596516649, 1189641421,

...

srandom(time(NULL)); /* Create seed based on current time counted as seconds from 01/01/1970 */
int i=0;
for (i=0; i<10; i++) {
  printf("%ld, ", random()); /* Generates different sequences at different runs */
}

output:
1st run: 198682410, 2076262355, 910374899, 428635843, 2084827500, 1558698420, 4459146, 733695321, 2044378618, 1649046624,
2nd run: 1127071427, 252907983, 1358798372, 2101446505, 1514711759, 229790273, 954268511, 1116446419, 368192457, 1297948050,
3rd run: 2052868434, 1645663878, 731874735, 1624006793, 938447420, 1046134947, 1901136083, 418123888, 836428296, 2017467418,
...

In the previous examples, seeding in rand() and random() is done using the time() function, which returns the current time calculated as the number of seconds that have passed since 01/01/January 1, 1970. Depending on the application and the desirable level of security, a programmer may choose alternative ways to seed PRNGs. In general, hardware is more capable than humans of generating real random numbers . (For for example, generate a  by generating a sequence of bits by sampling the thermal noise of a diode and use this as using the result as a seed).)

Compliant Solution (Windows)

CryptGenRandom() does not run the risk of not being properly seeded . The reason for that is that its because its arguments serve as seeders. From the Microsoft Developer Network CryptGenRandom() reference [MSDN]:

The CryptGenRandom() function fills a buffer with cryptographically random bytes.

Syntax

Code Block
BOOL WINAPI CryptGenRandom( __in HCRYPTPROV hProv, __in DWORD dwLen, __inout BYTE *pbBuffer );

Parameters

hProv [in]
    Handle of acryptographic a cryptographic service provider (CSP) created by a call toCryptAcquireContext.
dwLen [in]
    Number of bytes of random data to be generated.
pbBuffer [in, out]
    Buffer to receive the returned data. This buffer must be at leastdwLenbytes in length.
    Optionally, the application can fill this buffer with data to use as an auxiliary random seed.

HCRYPTPROV   hCryptProv;

/* union stores the random number generated by CryptGenRandom() */
union  {
  BYTE bs[sizeof(long int)];
  long int li;
} rand_buf;

/* An example of instantiating the CSP */
if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
  printf("CryptAcquireContext succeeded.\n");
}
else {
  printf("Error during CryptAcquireContext!\n");
}

for (int i=0; i<10; i++) {
  if (!CryptGenRandom(hCryptProv, sizeof(rand_buf), (BYTE*) &rand_buf)) {
    printf("Error\n");
  }
   else {
     printf("%ld, ", rand_buf.li);
  }
}

output:
1st run: -1597837311, 906130682, -1308031886, 1048837407, -931041900, -658114613, -1709220953, -1019697289, 1802206541, 406505841,
2nd run: 885904119, -687379556, -1782296854, 1443701916, -624291047, 2049692692, -990451563, -142307804, 1257079211, 897185104,
3rd run: 190598304, -1537409464, 1594174739, -424401916, -1975153474, 826912927, 1705549595, -1515331215, 474951399, 1982500583,
...

...

Related Vulnerabilities

...

MITRE CWE: CWE-327 , "Use of a Broken or Risky Cryptographic Algorithmbroken or risky cryptographic algorithm"

MITRE CWE: CWE-330, "Use of Insufficiently Random Valuesinsufficiently random values"

...

Sources

[C++ Reference] Standard C Library

...