CWE-339—Small Seed Space in PRNG

名称

Small Seed Space in PRNG

描述

A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.

PRNGs are entirely deterministic once seeded, so it should be extremely difficult to guess the seed. If an attacker can collect the outputs of a PRNG and then brute force the seed by trying every possibility to see which seed matches the observed output, then the attacker will know the output of any subsequent calls to the PRNG. A small seed space implies that the attacker will have far fewer possible values to try to exhaust all possibilities.

常见后果

范围：

Other

影响：

Varies by Context

相关 CWE

• CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-341Predictable from Observable State