Page History

...

The C Standard rand() function makes no guarantees as to the quality of the random sequence produced. The numbers generated by some implementations of rand() have a comparatively short cycle , and the numbers can be predictable. Applications that have strong pseudorandom number requirements must use a generator that is known to be sufficient for their needs.

...

To achieve the best random numbers possible, an implementation-specific function must be used. When unpredictability is crucial and speed is not an issue, as in the creation of strong cryptographic keys, use a true entropy source, such as /dev/random, or a hardware device capable of generating random numbers. Note that the The /dev/random device can block for a long time if there are not enough events going on to generate sufficient entropy.

...

On Windows platforms, the CryptGenRandom BCryptGenRandom() function can be used to generate cryptographically strong random numbers. Note that the exact details of the implementation are unknown, including, for example, what source of entropy CryptGenRandom() uses. From the The Microsoft Developer Network CryptGenRandomBCryptGenRandom() reference [MSDN] states:

If an application has access to a good random source, it can fill the pbBuffer buffer with some random data before calling CryptGenRandom(). The CSP [cryptographic service provider] then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the pbBuffer buffer before calling CryptGenRandom()The default random number provider implements an algorithm for generating random numbers that complies with the NIST SP800-90 standard, specifically the CTR_DRBG portion of that standard.

#include <Windows.h>
#include <wincrypt<bcrypt.h>
#include <stdio.h>
 

#pragma comment(lib, "Bcrypt")

void func(void) {
  BCRYPT_ALG_HANDLE Prov;
  HCRYPTPROVint provBuffer;
  if (CryptAcquireContext(&prov, NULL, NULL,
(!BCRYPT_SUCCESS(
          BCryptOpenAlgorithmProvider(&Prov, BCRYPT_RNG_ALGORITHM,
                                      PROV_RSA_FULLNULL, 0))) {
    long/* inthandle li = 0;error */
  }
  if (!BCRYPT_SUCCESS(CryptGenRandomBCryptGenRandom(provProv, sizeof(liPUCHAR), (BYTE *)&li)) {
Buffer),
           printf("Random number: %ld\n", li);
    } else {
      /* Handle error */
    }
    if (!CryptReleaseContext(provsizeof(Buffer), 0))) {
      /* Handlehandle error */
    }
   } else {printf("Random number: %d\n", Buffer);
    /* Handle error */
  }BCryptCloseAlgorithmProvider(Prov, 0);
}

Risk Assessment

The use of the rand() function can result in predictable random numbers.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-327 and MSC30-C

• CWE-327 forbids “broken or risky cryptographic algorithms” but does not specify what constitutes such an algo.

• Per CERT judgement, rand() qualifies, so:

• CWE-327 = Union( MSC30-C, list) where list =

• Invocation of broken/risky crypto algorithms besides rand()

CWE-338 and MSC30-C

CWE-338 = Union( MSC30-C, list) where list =

• Use of a weak PRNG besides standard C rand().

CWE-330 and MSC30-C

Independent( MSC30-C, MSC32-C, CON33-C)

CWE-330 = Union( MSC30-C, MSC32-C, CON33-C, list) where list = other improper use or creation of random values. (EG the would qualify)

MSC30-C, MSC32-C and CON33-C are independent, they have no intersections. They each specify distinct errors regarding PRNGs.

CWE-676 and MSC30-C

• Independent( ENV33-C, CON33-C, STR31-C, EXP33-C, MSC30-C, ERR34-C)

• MSC30-C implies that rand() is dangerous.

• CWE-676 = Union( MSC30-C, list) where list =

• Invocation of other dangerous functions, besides rand().

Bibliography

...

...

Image Modified Image Modified Image Modified