COMMON WEAKNESS ENUMERATIONDraft

CWE-342

Predictable Exact Value from Previous Values

An exact value or random number can be precisely predicted by observing previous values.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

An exact value or random number can be precisely predicted by observing previous values.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Varies by Context

Etkilenen güvenlik alanları: Other

Savunma

Nasıl önlenir ve çözülür?

Tüm evreler

Genel azaltım ve savunma yaklaşımı

Detay
Increase the entropy used to seed a PRNG.

Architecture and Design · Requirements

Libraries or Frameworks

Detay
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Implementation

Uygulama aşaması savunması

Detay
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.