CWE一覧に戻る
CWE-337

疑似乱数生成器(PRNG)における予測可能なシード

Predictable Seed in Pseudo-Random Number Generator (PRNG)
脆弱性 レビュー中
JA

疑似乱数生成器(PRNG)は、プロセスIDやシステム時間などの予測可能なシードから初期化される。

予測可能なシードを使用することで、攻撃者がPRNGによって生成される乱数を予測するためにテストする必要がある可能性のあるシードの数を大幅に減らすことができる。

EN

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.

Scope: Other / Impact: Varies by Context
Use non-predictable inputs for seed generation.
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
MITRE公式ページ — CWE-337