Skip to content
OpenAdvisories

Weakness (CWE)

CWE-343: Predictable Value Range from Previous Values

Base Draft

The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.

How to prevent it (4 mitigations)

  1. Architecture and Design, Implementation

    The output of a random number generator
    should not be predictable based on observations of
    previous values.

  2. Implementation

    Increase the entropy used to seed a PRNG.

  3. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

  4. Implementation

    Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-343

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.