Page History

John von Neumann's quote is widely known:

Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin.

Pseudorandom number generators (PRNGs) use deterministic mathematical algorithms to produce a sequence of numbers with good statistical properties. However, but the sequences of numbers produced are not genuinely randomfail to achieve true randomness. PRNGs usually start with an arithmetic seed value. The algorithm uses this seed to generate an output value and a new seed, which is used to generate the next value, and so on.

The Java API provides a PRNG, the java.util.Random class. This PRNG is portable and repeatable. Consequently, if two random instances instances of the java.util.Random class that are created using the same seed , they will generate identical sequences of numbers in all Java implementations. Sometimes the same seed is Seed values are often reused on application initialization or after every system reboot. At In other timescases, the seed is derived from the current time obtained from the system clock is used to derive the seed. An adversary attacker can learn the value of the seed by performing some reconnaissance on the vulnerable target and proceed to can then build a lookup table for estimating future seed values.

Noncompliant Code Example

Consequently, the java.util.Random class must not be used either for security-critical applications or for protecting sensitive data. Use a more secure random number generator, such as the java.security.SecureRandom class.

Noncompliant Code Example

If the same seed value is used, the same sequence of numbers is obtained; as a result, the numbers are not "random". This noncompliant code example uses the insecure java.util.Random class. This class produces an identical sequence of numbers for each given seed value; consequently, the sequence of numbers is predictable.

import java.util.Random;
// ...

Random number = new Random(123L);
//...
for (int i = 0; i < 20; i++) {
  // Generate another random integer in the range [0, 20]
  int n = number.nextInt(21);
  System.out.println(n);
}

There are cases where the same sequence of random numbers is desirable, such as when running regression tests of program behavior. In other applications, generating the same sequence of random numbers may expose a vulnerability.

Compliant Solution

This compliant solution uses the java.security.SecureRandom class to produce high-quality random numbers:

import java.security.SecureRandom;
import java.security.NoSuchAlgorithmException;
// ...

public static void main (String args[]) {
  SecureRandom number = new SecureRandom();
  // Generate 20 integers 0..20
  for (int i = 0; i < 20; i++) {
    System.out.println(number.nextInt(21));
  }
}

Compliant Solution (Java 8)

This compliant solution uses the SecureRandom.getInstanceStrong() method, introduced in Java 8, to use a strong RNG algorithm, if one is available.

import java.security.SecureRandom;
import java.security.NoSuchAlgorithmException;
// ...

public static void main (String args[]) {
   try {
     SecureRandom number = SecureRandom.getInstancegetInstanceStrong("SHA1PRNG");
     // Generate 20 integers 0..20
     for (int i = 0; i < 20; i++) {
       System.out.println(number.nextInt(21));
     }
   } catch (NoSuchAlgorithmException nsae) { 
     // Forward to handler
   }
}

Exceptions

MSC30MSC02-J-EX1EX0: Using a null seed value (as opposed to reusing it) may improve security marginally but should only be used for non-critical applicationsthe default constructor for java.util.Random applies a seed value that is "very likely to be distinct from any other invocation of this constructor" [API 2014] and may improve security marginally. As a result, it may be used only for noncritical applications operating on nonsensitive data. Java's default seed uses the system's time in milliseconds. This exception is not recommended for applications requiring high security (for instance, session IDs should be adequately random). When used, explicit documentation of this exception is encouragedrequired.

import java.util.Random;
// ...

Random number = new Random(); // Used only for demo purposes
int n;
//...
for (int i = 0; i i<20< 20; i++) {
  // Re-seedReseed generator
  number = new Random();
  // Generate another random integer in the range [0, 20]
  n = number.nextInt(21);
  System.out.println(n);
}

For noncritical cases, such as adding some randomness to a game or unit testing, the use of class Random is acceptable. However, it is worth reiterating that the resulting low-entropy random numbers are not insufficiently random enough to be used for more serious security-critical applications, such as cryptography.

MSC02-J-EX1: Predictable sequences of pseudorandom numbers are required in some cases, such as when running regression tests of program behavior. Use of the insecure java.util.Random class is permitted in such cases. However, security-related applications may invoke this exception only for testing purposes; this exception may not be applied in a production context.

Risk Assessment

Predictable random number sequences can weaken the security of critical applications such as cryptography.

Automated Detection

...

Tool	Version	Checker	Description
CodeSonar	Include Page CodeSonar_V CodeSonar_V	JAVA.HARDCODED.SEED JAVA.LIB.RAND.FUNC JAVA.CRYPTO.RCF JAVA.CRYPTO.RA JAVA.CRYPTO.RF JAVA.CRYPTO.BASE64 JAVA.CRYPTO.WHAF AVA.LIB.RAND.LEGACY.GEN	Hardcoded Random Seed (Java) Insecure Random Number Generator (Java) Risky Cipher Field (Java) Risky Cryptographic Algorithm (Java) Risky Cryptographic Field (Java) Unsafe Base64 Encoding (Java) Weak Hash Algorithm Field (Java) Legacy Random Generator (Java)
Coverity	7.5	RISKY_CRYPTO	Implemented
Parasoft Jtest	Include Page Parasoft_V Parasoft_V	CRT.MSC02.SRD	Use 'java.security.SecureRandom' instead of 'java.util.Random' or 'Math.random()'
SonarQube	Include Page SonarQube_V SonarQube_V	S2245

Related Vulnerabilities

CVE-2006-6969

Other Languages

...

 describes a vulnerability that enables attackers to guess session identifiers, bypass authentication requirements, and conduct cross-site request forgery attacks.

Related Guidelines

...

...

...

...

...

...

...

Bibliography

...

Image Added Image Added Image Added 2009|AA. Bibliography#MITRE 09]\] [CWE ID 330|http://cwe.mitre.org/data/definitions/330.html] "Use of Insufficiently Random Values", [CWE ID 327 |http://cwe.mitre.org/data/definitions/327.html], "Use of a Broken or Risky Cryptographic Algorithm," [CWE ID 330|http://cwe.mitre.org/data/definitions/330.html], "Use of Insufficiently Random Values", [CWE ID 333| http://cwe.mitre.org/data/definitions/333.html] "Failure to Handle Insufficient Entropy in TRNG", [CWE ID 332|http://cwe.mitre.org/data/definitions/332.html] "Insufficient Entropy in PRNG", [CWE ID 337|http://cwe.mitre.org/data/definitions/337.html] "Predictable Seed in PRNG", [CWE ID 336|http://cwe.mitre.org/data/definitions/336.html] "Same Seed in PRNG"MSC01-J. Do not use insecure or weak cryptographic algorithms      49. Miscellaneous (MSC)      MSC03-J. Never hardcode sensitive information