CWE-332—Insufficient Entropy in PRNG
PUBLISHEDweakness recordMedium
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID:
- CWE-332
- Abstraction:
- Variant
- Structure:
- Simple
- Status:
- Draft
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2025-12-11
Weakness Name
Insufficient Entropy in PRNG
Description
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
Common Consequences
- Scope:
- Availability
- Impact:
- DoS: Crash, Exit, or Restart
- Notes:
- If a pseudo-random number generator is using a limited entropy source which runs out (if the generator fails closed), the program may pause or crash.
- Scope:
- Access Control, Other
- Impact:
- Bypass Protection Mechanism, Other
- Notes:
- If a PRNG is using a limited entropy source which runs out, and the generator fails open, the generator could produce predictable random numbers. Potentially a weak source of random numbers could weaken the encryption method used for authentication of users.