COMMON WEAKNESS ENUMERATIONDraft

CWE-1241

Use of Predictable Algorithm in Random Number Generator

The device uses an algorithm that is predictable and generates a pseudo-random number.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The device uses an algorithm that is predictable and generates a pseudo-random number.

Extended description

Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

In many cases, the design originally defines a cryptographically secure random number generator, but is then changed during implementation due to unforeseen constraints.

Risk

What does successful exploitation lead to?

Read Application Data

Affected security scopes: Confidentiality

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.

Implementation

Implementation-phase defence

Detail
It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.