Predictable Value Range from Previous Values |
Weakness ID: 343 (Weakness Base) | Status: Draft |
Description Summary
Extended Description
The output of a random number generator should not be predictable based on observations of previous values. In some cases, an attacker cannot predict the exact value that will be produced next, but can narrow down the possibilities significantly. This reduces the amount of effort to perform a brute force attack. For example, suppose the product generates random numbers between 1 and 100, but it always produces a larger value until it reaches 100. If the generator produces an 80, then the attacker knows that the next value will be somewhere between 81 and 100. Instead of 100 possibilities, the attacker only needs to consider 20.
Increase the entropy used to seed a PRNG. |
Phase: Implementation Perform FIPS 140-2 tests on data to catch obvious entropy problems. |
Phase: Implementation Consider a PRNG which re-seeds itself, as needed from a high quality pseudo-random output, like hardware devices. |
Nature | Type | ID | Name | View(s) this relationship pertains to |
---|---|---|---|---|
ChildOf | Weakness Class | 330 | Use of Insufficiently Random Values | Development Concepts (primary)699 Research Concepts (primary)1000 |
Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
---|---|---|---|
PLOVER | Predictable Value Range from Previous Values |
Michal Zalewski. "Strange Attractors and TCP/IP Sequence Number Analysis". 2001. <http://www.bindview.com/Services/Razor/Papers/2001/tcpseq.cfm>. |
Submissions | ||||
---|---|---|---|---|
Submission Date | Submitter | Organization | Source | |
PLOVER | Externally Mined | |||
Modifications | ||||
Modification Date | Modifier | Organization | Source | |
2008-07-01 | Eric Dalci | Cigital | External | |
updated Time of Introduction | ||||
2008-09-08 | CWE Content Team | MITRE | Internal | |
updated Relationships, Taxonomy Mappings | ||||
2008-10-14 | CWE Content Team | MITRE | Internal | |
updated Description | ||||
2009-03-10 | CWE Content Team | MITRE | Internal | |
updated Potential Mitigations | ||||
2009-12-28 | CWE Content Team | MITRE | Internal | |
updated Potential Mitigations |