CWE-333—Improper Handling of Insufficient Entropy in TRNG

名称

Improper Handling of Insufficient Entropy in TRNG

描述

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.

常见后果

范围：

Availability

影响：

DoS: Crash, Exit, or Restart

注释：

A program may crash or block if it runs out of random numbers.

相关 CWE

• CWE-331Insufficient Entropy
• CWE-755Improper Handling of Exceptional ConditionsMedium