Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1241: Use of Predictable Algorithm in Random Number Generator

Base Draft

The device uses an algorithm that is predictable and generates a pseudo-random number.

More detail

Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering.

How to prevent it (1 mitigation)

  1. Architecture and Design, Implementation

    It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.

Source: MITRE CWE-1241

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.