CWE一覧に戻る
CWE-1241

乱数生成における予測可能なアルゴリズムの使用

Use of Predictable Algorithm in Random Number Generator
脆弱性 レビュー中
JA

このデバイスは予測可能なアルゴリズムを使用し、擬似乱数を生成する。

疑似乱数生成アルゴリズムは、レジスタが有限個の可能な状態を持ち、最終的にパターンを繰り返すため、予測可能である。その結果、擬似乱数生成器(PRNG)は、そのランダム性を損なったり、リバースエンジニアリングや改ざんなどのさまざまな攻撃に内部状態をさらす可能性がある。

EN

The device uses an algorithm that is predictable and generates a pseudo-random number.

Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering.

Scope: Confidentiality / Impact: Read Application Data
It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
It is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
MITRE公式ページ — CWE-1241