Page History

Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random.

The C Standard function Standard rand() (available in stdlib.h) does not have good random number properties function, exposed through the C++ standard library through <cstdlib> as std::rand(), makes no guarantees as to the quality of the random sequence produced. The numbers generated by some implementations of std::rand() have  have a comparatively short cycle, and the numbers can be predictable. Applications that have strong pseudorandom number requirements must use a generator that is known to be sufficient for their needs.

Noncompliant Code Example

The following noncompliant code generates an ID with a numeric part produced by calling the rand() function. The IDs produced are predictable and have limited randomness. Further, depending on the value of RAND_MAX, the resulting value can have modulo bias.

enum {len = 12};
char id[len];  /* id will hold the ID, starting with 
                * the characters "ID" followed by a 
                * random integer */
int r;
int num;
/* ... */
r = rand();  /* generate a random integer */
num = snprintf(id, len, "ID%-d", r);  /* generate the ID */
/* ... */

Compliant Solution (POSIX)

In this compliant solution, a better pseudorandom number generator is the random() function. While the low-dozen bits generated by rand() go through a cyclical pattern, all the bits generated by random() are usable.

#include <cstdlib>
#include <string>
 
void f() {
  std::string id("ID"); // Holds the ID, starting with 

enum {len = 12};
char id[len];  /* id will hold the ID, starting with 
                * the characters "ID" followed by a 
                * random integer */
int r;
int num;
/* ... */
time_t now = time(NULL);
if (now == (time_t) -1) {
  /* handle error */
}
srandom(now);  /* seed the PRNG with the current time */
/* ... */
r = random();  /* generate a random integer */
num = snprintf(id, len, "ID%-d", r);  /* generate the ID */
/* ... */

The rand48 family of functions provides another alternative for pseudorandom numbers.

Although not specified by POSIX, arc4random() is an option on systems that support it. The arc4random(3) manual page says that

arc4random() fits into a middle ground not covered by other subsystems such as the strong, slow, and resource expensive random devices described in random(4) versus the fast but poor quality interfaces described in rand(3), random(3), and drand48(3).

To achieve the best random numbers possible, an implementation-specific function must be used. When unpredictability matters and speed is not an issue, such as in the creation of strong cryptographic keys, a true entropy source such as /dev/random or a hardware device capable of generating random numbers should be used. Note that the /dev/random device may block for a long time if there are not enough events going on to generate sufficient entropy.

Compliant Solution (Windows)

In the compliant solution, on Windows platforms, the [{{CryptGenRandom()}}|http://msdn2.microsoft.com/en-us/library/aa379942.aspx] function may be used to generate cryptographically strong random numbers.  It is important to note that the exact details of the implementation are unknown, and it is unknown what source of entropy the {{CryptGenRandom()}} uses.  The Microsoft Developer Network {{CryptGenRandom()}} reference \[[MSDN|AA. Bibliography#MSDN]\] says,

Wiki Markup
If an application has access to a good random source, it can fill the {{pbBuffer}} buffer with some random data before calling {{CryptGenRandom()}}. The CSP \[cryptographic service provider\] then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the {{pbBuffer}} buffer before calling {{CryptGenRandom()}}.

#include<Wincrypt.h>

HCRYPTPROV hCryptProv;
union {
    BYTE bs[sizeof(long int)];
    long int li;
} rand_buf;

if (!CryptGenRandom(hCryptProv, sizeof(rand_buf), &rand_buf) {
    /* Handle error */
} else {
    printf("Random number: %ld\n", rand_buf.li);
}

Risk Assessment

 by a random integer in the range [0-10000].
  id += std::to_string(std::rand() % 10000);
  // ...
}

Compliant Solution

The C++ standard library provides mechanisms for fine-grained control over pseudorandom number generation. It breaks random number generation into two parts: one is the algorithm responsible for providing random values (the engine), and the other is responsible for distribution of the random values via a density function (the distribution). The distribution object is not strictly required, but it works to ensure that values are properly distributed within a given range instead of improperly distributed due to bias issues. This compliant solution uses the Mersenne Twister algorithm as the engine for generating random values and a uniform distribution to negate the modulo bias from the noncompliant code example.

#include <random>
#include <string>
 
void f() {
  std::string id("ID"); // Holds the ID, starting with the characters "ID" followed
                        // by a random integer in the range [0-10000].
  std::uniform_int_distribution<int> distribution(0, 10000);
  std::random_device rd;
  std::mt19937 engine(rd());
  id += std::to_string(distribution(engine));
  // ...
}

This compliant solution also seeds the random number engine, in conformance with MSC51-CPP. Ensure your random number generator is properly seeded.

Risk Assessment

Using the std::Using the rand() function could lead to predictable random numbers.

Automated Detection

...

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V	bad-function (AUTOSAR.26.5.1A)	Fully checked
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC++-MSC50
Clang	Include Page Clang_40_V Clang_40_V	cert-msc50-cpp	Checked by clang-tidy
CodeSonar	Include Page CodeSonar_V CodeSonar_V	BADFUNC.RANDOM.RAND	Use of rand
Compass/ROSE
ECLAIR	Include Page ECLAIR_V ECLAIR_V	CC2.MSC30	Fully implemented
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C++5028
Klocwork	Include Page Klocwork_V Klocwork_V	CERT.MSC.STD_RAND_CALL
LDRA tool suite	Include Page LDRA_V LDRA_V	44 S	Enhanced Enforcement
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_CPP-MSC50-a	Do not use the rand() function for generating pseudorandom numbers
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C++: MSC50-CPP	Checks for use of vulnerable pseudo-random number generator (rule partially covered)
RuleChecker	Include Page RuleChecker_V RuleChecker_V	bad-function (AUTOSAR.26.5.1A)	Fully checked

The LDRA tool suite V 7.6.0 can detect violations of this rule.

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

Compass/ROSE can detect violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

...

Related Guidelines

...

...

...

...

...

\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.20.2.1, "The rand function"
\[[MITRE 2007|AA. Bibliography#MITRE 07]\] [CWE ID 327 |http://cwe.mitre.org/data/definitions/327.html], "Use of a Broken or Risky Cryptographic Algorithm," [CWE ID 330|http://cwe.mitre.org/data/definitions/330.html], "Use of Insufficiently Random Values" 
\[[MSDN 2010|AA. Bibliography#MSDN 10]\] "[CryptGenRandom Function|http://msdn.microsoft.com/en-us/library/aa379942.aspx]."

Bibliography

...

Image Added Image Added Image AddedMSC23-CPP. Ensure objects are fully initialized before allowing access.      49. Miscellaneous (MSC)      MSC31-CPP. Ensure that return values are compared against the proper type