Page History

...

Calling a PRNG in the same initial state, either without seeding it explicitly or by seeding it with the same value, results in generating the same sequence of random numbers in different runs of the program. Suppose Consider a PRNG function that is seeded with some initial seed value and is consecutively called 10 times consecutively to produce a sequence of 10 random numbers. Suppose also that this , S. If the PRNG is not subsequently seeded . Running the code for the first time produces the sequence S = <r1, r2, r3, r4, r5, r6, r7, r8, r9, r10>. Running the code a second time produces exactly the same S sequence. Generally, any subsequent runs of the code with the same initial seed value, then it will generate the same sequence S sequence.

As a result, after the first run of the an improperly seeded PRNG, an attacker can predict the sequence of random numbers that will be generated in the future runs. Improperly seeding or failing to seed the PRNG can lead to vulnerabilities, especially in security protocols.

The solution is to always to ensure that your the PRNG is always properly seeded. Seeding a PRNG means that it A properly seeded PRNG will generate a different sequences sequence of random numbers at any call.each time it is run.

Not It is worth noting that not all random number generators can be seeded. True random number generators that rely on hardware to produce completely unpredictable results do not need to be and cannot be seeded. Some high-quality PRNGs, such as the /dev/random device on some UNIX systems, also cannot be seeded. This rule applies only to algorithmic pseudorandom number generators that can be seeded.

...

This noncompliant code example generates a sequence of 10 pseudorandom numbers using the random() function. When random() is not seeded, it behaves like rand(), producing the same sequence of random numbers at different callseach time any program that uses it is run.

#include <stdio.h>
#include <stdlib.h>
 
void func(void) {
  for (unsigned int i = 0; i < 10; ++i) {
    /* Always generates the same sequence */
    printf("%ld, ", random());
  }
}

...

Compliant Solution (POSIX)

Use Call srandom() before invoking random() to seed the random sequence generated by random(). The code This compliant solution produces different random number sequences at different calls.each time the function is called, depending on the resolution of the system clock:

#include <stdio.h>
#include <stdlib.h>
#include <time.h>
 
void func(void) {
  /* struct timespec ts;
   * Create seed based on current time counted as
   * seconds from 01/01/1970.
   */
  srandom(time(NULL));
if (timespec_get(&ts, TIME_UTC) == 0) {
    /* Handle error */
  } else {
    srandom(ts.tv_nsec ^ ts.tv_sec);
    for (unsigned int i = 0; i < 10; ++i) {
      /* Generates different sequences at different runs */
    printf  printf("%ld, ", random());
    }
  }
}

The output is as follows:

1st run: 198682410, 2076262355, 910374899, 428635843, 2084827500, 1558698420, 4459146, 733695321, 2044378618, 1649046624,
2nd run: 1127071427, 252907983, 1358798372, 2101446505, 1514711759, 229790273, 954268511, 1116446419, 368192457,
         1297948050,
3rd run: 2052868434, 1645663878, 731874735, 1624006793, 938447420, 1046134947, 1901136083, 418123888, 836428296,
         2017467418,

In the previous examples, seeding in rand() and random() is performed using the time() function, which returns the current time calculated as the number of seconds that have passed since January 1, 1970This may not be sufficiently random for concurrent execution, which may lead to correlated generated series in different threads. Depending on the application and the desirable desired level of security, a programmer may choose alternative ways to seed PRNGs. In general, hardware is more capable than humans software of generating real random numbers (for example, by generating a sequence of bits by sampling the thermal noise of a diode and using the result as a seed).

Compliant Solution (Windows)

CryptGenRandomThe BCryptGenRandom() function does not run the risk of not being properly seeded because its arguments serve as seeders.:

#include <stdio.h>
#include <Windows.h>
#include <Bcrypt.h>
#include <wincrypt<Ntstatus.h>
#include <stdio<Wincrypt.h>
 
void func(void) {
  BCRYPT_ALG_HANDLE hAlgorithm HCRYPTPROV= hCryptProvNULL;
  long rand_buf;
  /*PUCHAR ExamplepbBuffer of= instantiating the CSP */
  if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
    printf("CryptAcquireContext succeeded.\n");
  } else {
    printf("Error during CryptAcquireContext!\n");
  }

  (PUCHAR) &rand_buf;
  ULONG cbBuffer = sizeof(rand_buf);
  ULONG dwFlags = BCRYPT_USE_SYSTEM_PREFERRED_RNG;
  NTSTATUS status;
  for (unsigned int i = 0; i < 10; ++i) {
    ifstatus = (!CryptGenRandom(hCryptProv, sizeof(rand_buf), (BYTE *)&rand_buf))BCryptGenRandom(hAlgorithm, pbBuffer, cbBuffer, dwFlags);
    if (status == STATUS_SUCCESS) {
      printf("Error\n"%ld, ", rand_buf);
    } else {
      printf("%ld, ", rand_buf); /* Handle Error */
    }
  }
}

The output is as follows:

1st run: -1597837311683378946, 9061306821957231690, -13080318861933176011, 1048837407-1745403355, -931041900883473417, -658114613882992405, -1709220953169629816, -10196972891824800038, 1802206541899851668,
         406505841,1702784647, 
2nd run: 885904119-58750553, -6873795561921870721, -17822968541973269161, 14437019161512649964, -624291047673518452, 2049692692234003619, -9904515631622633366, 1312389688, -1423078042125631172, 12570792112067680022,
         897185104,
3rd run: 190598304-189899579, -15374094641220698973, 1594174739752205360, -4244019161826365616, -197515347479310867, 8269129271430950090, 1705549595-283206168, -1515331215941773185, 474951399129633665,
         1982500583, 543448789, 

Risk Assessment

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-327 and MSC32-C

• Intersection( MSC30-C, MSC32-C) = Ø

• MSC32-C says to properly seed pseudorandom number generators. For example, if you call rand(), make sure to seed it properly by calling srand() first. So far, we haven’t found any calls to rand().

• Failure to seed a

...

• PRNG causes it to produce reproducible (hence insecure) series of random numbers.

• CWE-327 = Union( MSC32-C, list) where list =

• Invocation of broken/risky crypto algorithms that are not properly seeded

CWE-330 and MSC32-C

Independent( MSC30-C, MSC32-C, CON33-C)

CWE-330

...

= Union( MSC30-C, MSC32-C, CON33-C, list) where list = other improper use or creation of random values. (EG the would qualify)

MSC30-C, MSC32-C and CON33-C are independent, they have no intersections. They each specify distinct errors regarding PRNGs.

Bibliography

...

Image Modified Image Modified Image Modified