CWE-339 PRNG中的种子空间太小

Small Seed Space in PRNG

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

A PRNG uses a relatively small space of seeds.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 335 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 335 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: PeerOf cwe_CWE_ID: 341 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Architecture and Design

策略:

Use well vetted pseudo-random number generating algorithms with adequate length seeds. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.

MIT-2 ['Architecture and Design', 'Requirements']

策略: Libraries or Frameworks

Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Notes

分类映射

引用

• REF-267 SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES

文章来源于互联网:scap中文网