Page History

Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random.

The C Standard function rand() (available in stdlib.h) does not have good random number properties function makes no guarantees as to the quality of the random sequence produced. The numbers generated by some implementations of rand() have a comparatively short cycle , and the numbers may can be predictable. Applications that have strong pseudorandom number requirements must use a generator that is known to be sufficient for their needs.

Noncompliant Code Example

The following noncompliant code generates an ID with a numeric part produced by calling the rand() function. The IDs produced are predictable and have limited randomness.

#include <stdio.h>
#include <stdlib.h>
 
enum { len = 12 };
char id[len];
 
void func(void) {
  /*
   * id will hold the ID, starting with
           the characters
     * the characters "ID" followed by a
 random integer.
   */
  char id[len];         * random integer */

  int r;
  int num;
  /* ... */
  r = rand();  /* generateGenerate a random integer */
  num = snprintf(id, len, "ID%-d", r);  /* generateGenerate the ID */
  /* ... */
}

Compliant Solution (POSIX)

A better pseudorandom number generator is the randomThis compliant solution replaces the rand() function . While the low dozen bits generated by rand() go through a cyclic pattern, all the bits generated by with the POSIX random() are usable. function:

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

enum { len = 12 };
char id[len]; 

void func(void) {
  /*
   * id will hold the ID, starting with
             the characters
   * the characters "ID" followed by a
 random integer.
   */
  char id[len];         * random integer */

  int r;
  int num;
  /* ... */
time_t  nowstruct = time(NULL)timespec ts;
  if (now(timespec_get(&ts, TIME_UTC) == (time_t) -10) {
    /* handleHandle error */
  }
  srandom(nowts.tv_nsec ^ ts.tv_sec);  /* seedSeed the PRNG with the current time */
  /* ... */
  r = random();  /* generateGenerate a random integer */
  num = snprintf(id, len, "ID%-d", r);  /* generateGenerate the ID */
  /* ... */
}

The POSIX random() function is a better pseudorandom number generator. Although on some platforms the low dozen bits generated by rand() go through a cyclic pattern, all the bits generated by random() are usable. The rand48 family of functions provides another alternative for pseudorandom numbers.

Although not specified by POSIX, arc4random() is an option on another possibility for systems that support it. From the The arc4random(3) manual page :
[OpenBSD] states

... provides higher quality of data than those arc4random() fits into a middle ground not covered by other subsystems such as the strong, slow, and resource expensive random devices described in random(4) versus the fast but poor quality interfaces described in rand(3), random(3), and drand48(3).

To achieve the best random numbers possible, an implementation-specific function must be used. When unpredictability

...

is crucial and speed is not an issue,

...

as in the creation of strong cryptographic keys, use a true entropy source, such as /dev/random, or a hardware device capable of generating random numbers.

...

The /dev/random device

...

can block for a long time if there are not enough events going on to generate sufficient entropy.

Compliant Solution (Windows)

Wiki MarkupOn Windows platforms, the [{{CryptGenRandom()}}|http://msdn2.microsoft.com/en-us/library/aa379942.aspx] function may be used to generate cryptographically strong random numbers. Note that the exact details of the implementation are unknown including, for example, what source of entropy {{CryptGenRandom()}} uses. From the Microsoft Developer Network {{CryptGenRandom()}} reference \[[MSDN|AA. Bibliography#MSDN]\]:

Wiki Markup
If an application has access to a good random source, it can fill the {{pbBuffer}} buffer with some random data before calling {{CryptGenRandom()}}. The CSP \[cryptographic service provider\] then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the {{pbBuffer}} buffer before calling {{CryptGenRandom()}}.

the BCryptGenRandom() function can be used to generate cryptographically strong random numbers. The Microsoft Developer Network BCryptGenRandom() reference [MSDN] states:

The default random number provider implements an algorithm for generating random numbers that complies with the NIST SP800-90 standard, specifically the CTR_DRBG portion of that standard.

#include <Windows.h>
#include <bcrypt.h>
#include <stdio.h>

#pragma comment(lib, "Bcrypt")

void func(void) {
  BCRYPT_ALG_HANDLE Prov;
  int Buffer;
  if (!BCRYPT_SUCCESS(
          BCryptOpenAlgorithmProvider(&Prov, BCRYPT_RNG_ALGORITHM,
                                      NULL, 0))) {
    /* handle error */
  }
  if (!BCRYPT_SUCCESS(BCryptGenRandom(Prov, (PUCHAR) (&Buffer),
                                      sizeof(Buffer), 0))

#include<Wincrypt.h>

HCRYPTPROV hCryptProv;
union {
    BYTE bs[sizeof(long int)];
    long int li;
} rand_buf;

if (!CryptGenRandom(hCryptProv, sizeof(rand_buf), &rand_buf) {
    /* Handlehandle error */
} else {}
    printf("Random number: %ld%d\n", rand_buf.liBuffer);
  BCryptCloseAlgorithmProvider(Prov, 0);
}

Risk Assessment

Using The use of the rand() function leads to possibly can result in predictable random numbers.

Automated Detection

The LDRA tool suite V 7.6.0 can detect violations of this rule.

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

...

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V	stdlib-use-rand	Fully checked
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC-MSC30
Clang	Include Page Clang_40_V Clang_40_V	cert-msc30-c	Checked by clang-tidy
CodeSonar	Include Page CodeSonar_V CodeSonar_V	BADFUNC.RANDOM.RAND	Use of rand
Compass/ROSE
Coverity	Include Page Coverity_V Coverity_V	DONTCALL	Implemented - weak support
Cppcheck Premium	Include Page Cppcheck Premium_V Cppcheck Premium_V	premium-cert-msc30-c	Fully implemented
ECLAIR	Include Page ECLAIR_V ECLAIR_V	CC2.MSC30	Fully implemented
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C5022 C++5029
Klocwork	Include Page Klocwork_V Klocwork_V	CERT.MSC.STD_RAND_CALL
LDRA tool suite	Include Page LDRA_V LDRA_V	44 S	Enhanced enforcement
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-MSC30-a	Do not use the rand() function for generating pseudorandom numbers
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	586	Fully supported
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rule MSC30-C	Checks for vulnerable pseudo-random number generator (rule fully covered)
RuleChecker	Include Page RuleChecker_V RuleChecker_V	stdlib-use-rand	Fully checked

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

...

Related Guidelines

Key here (explains table format and definitions)

...

...

...

...

...

...

...

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-327 and MSC30-C

• CWE-327 forbids “broken or risky cryptographic algorithms” but does not specify what constitutes such an algo.

• Per CERT judgement, rand() qualifies, so:

• CWE-327 = Union( MSC30-C, list) where list =

• Invocation of broken/risky crypto algorithms besides rand()

CWE-338 and MSC30-C

CWE-338 = Union( MSC30-C, list) where list =

• Use of a weak PRNG besides standard C rand().

CWE-330 and MSC30-C

Independent( MSC30-C, MSC32-C, CON33-C)

CWE-330 = Union( MSC30-C, MSC32-C, CON33-C, list) where list = other improper use or creation of random values. (EG the would qualify)

MSC30-C, MSC32-C and CON33-C are independent, they have no intersections. They each specify distinct errors regarding PRNGs.

CWE-676 and MSC30-C

• Independent( ENV33-C, CON33-C, STR31-C, EXP33-C, MSC30-C, ERR34-C)

• MSC30-C implies that rand() is dangerous.

• CWE-676 = Union( MSC30-C, list) where list =

• Invocation of other dangerous functions, besides rand().

Bibliography

...

Image Added Image Added Image Added

Bibliography

\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.20.2.1, "The rand function"
\[[MITRE 07|AA. Bibliography#MITRE 07]\] [CWE ID 327|http://cwe.mitre.org/data/definitions/327.html], "Use of a Broken or Risky Cryptographic Algorithm," [CWE ID 330|http://cwe.mitre.org/data/definitions/330.html], "Use of Insufficiently Random Values"
\[[MSDN|AA. Bibliography#MSDN]\] "[CryptGenRandom Function|http://msdn.microsoft.com/en-us/library/aa379942.aspx]"

Image Removed      49. Miscellaneous (MSC)      MSC31-C. Ensure that return values are compared against the proper type