Calling a A pseudo-random number generator (PRNG) is a deterministic algorithm capable of generating sequences of numbers that approximate the properties of random numbers. Each sequence is completely determined by the initial state of the PRNG and the algorithm for changing the state. Most PRNGs make it possible to set the initial state, also referred to as the "seed state." This is referred to as "seeding" the PRNG.
Calling a PRNG that is RNG) that is not seeded results in generating the same sequence of random numbers in different runs of the program.
Suppose an RNG PRNG function is called 10 times consecutively to produce a sequence of 10 random numbers. Suppose also that this RNG PRNG is not seeded. Running the code for the first time produces the sequence S = <r1, r2, r3, r4, r5, r6, r7, r8, r9, r10>. Running the code a second time produces the exact same S sequence. Generally, any subsequent runs of the code will generate the same S sequence.
As a result, after the first run of the RNGPRNG, an attacker can predict the sequence of random numbers that will be generated in the future runs. This can lead to many vulnerabilities, especially in security protocols.
As a solution, you should always ensure that your RNG PRNG is properly seeded. Seeding an RNG a PRNG means that it will generate different sequences of random numbers at any call.
It is worth noting that not all random number generators can be seeded. True random number generators (RNG) that rely on hardware to produce completely unpredictable results cannot be seeded. Some high quality pseudo-random generators such as the /dev/random device on some UNIX systems also cannot be seeded. This rule applies to algorithmic pseudo-random generators that make seeding possible.
Rule MSC30-C. Do not use the rand() function for generating pseudorandom numbers addresses RNGs PRNGs from a different perspective, which is the cycle of the pseudo-random number sequence. In other words, during a single run of an RNGa PRNG, the time interval after which the RNG PRNG generates the same random numbers. The rule MSC30-C deprecates the rand() function because it generates numbers that have a comparatively short cycle. The same rule proposes the use of the random() function for POSIX and CryptGenRandom() function for Windows.
The current rule (MSC32-C) examines, in terms of seeding, all three RNGs PRNGs mentioned in rule MSC30-C. Noncompliant code examples correspond to the use of an RNG a PRNG without a seed, while compliant solutions correspond to the same RNG PRNG being properly seeded. Rule MSC32-C complies to rule MSC30-C and does not recommend the use of the rand() function. Nevertheless, if it is unavoidable to use rand(), it should at least be properly seeded.
...
In the previous examples, seeding in rand() and random() is done using the time() function, which returns the current time calculated as the number of seconds that have passed since 01/01/1970. Depending on the application and the desirable level of security, a programmer may choose alternative ways to seed RNGsPRNGs. In general, hardware is more capable of generating real random numbers. (For example, generate a sequence of bits by sampling the thermal noise of a diode and use this as a seed.)
...