SEI CERT C++ Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 31

changes.mady.by.user Carol J. Lallier

Saved on

compared with

New Version 32

changes.mady.by.user Barbara White

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Consequently, after the first run of an improperly seeded PRNG, an attacker can predict the sequence of random numbers that will be generated in the future runs. Improperly seeding or failing to seed the PRNG can lead to vulnerabilities, especially in security protocols.

...

SEI CERT C Coding StandardMSC32-C. Properly seed pseudorandom number generators
MITRE CWE

CWE-327, Use of a Broken or Risky Cryptographic Algorithm
CWE-330, Use of Insufficiently Random Values
CWE-337, Predictable Seed in PRNG

Bibliography

[ISO/IEC 9899:2011]Subclause 7.22.2, "Pseudo-random Sequence Generation Functions"
[ISO/IEC 14882-2014]Subclause 26.5, "Random Number Generation"

...