CWE-1241
Use of Predictable Algorithm in Random Number Generator
2020-02-24
00h00 +00:00
00h00 +00:00
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Nama: Use of Predictable Algorithm in Random Number Generator
The device uses an algorithm that is predictable and generates a pseudo-random number.
Informasi Umum
Mode Pengenalan
Architecture and DesignImplementation : In many cases, the design originally defines a cryptographically secure random number generator, but is then changed during implementation due to unforeseen constraints.
Platform yang Berlaku
Teknologi
Kelas: System on Chip (Undetermined)Konsekuensi Umum
| Cakupan | Dampak | Kemungkinan |
|---|---|---|
| Confidentiality | Read Application Data | High |
Contoh yang Diamati
| Referensi | Deskripsi |
|---|---|
CVE-2021-3692 | PHP framework uses mt_rand() function (Marsenne Twister) when generating tokens |
Mitigasi yang Memungkinkan
Phases : Architecture and Design // ImplementationIt is highly recommended to use a true random number generator (TRNG) to ensure the security of encryption schemes. Hardware-based TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
Catatan Pemetaan Kerentanan
Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Pola Serangan Terkait
| CAPEC ID | Nama Pola Serangan |
|---|---|
| CAPEC-97 | Cryptanalysis
Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful. An attacker may have other goals as well, such as: Total Break (finding the secret key), Global Deduction (finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key), Information Deduction (gaining some information about plaintexts or ciphertexts that was not previously known) and Distinguishing Algorithm (the attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits). |
Catatan
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely. Within the developer and other communities, "randomness" is used heavily. However, within cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonly-used definitions, even within standards documents and cryptography papers. Future versions of CWE will attempt to define these terms and, if necessary, distinguish between them in ways that are appropriate for different communities but do not reduce the usability of CWE for mapping, understanding, or other scenarios.Referensi
REF-1370
rng_16.vhttps://github.com/HACK-EVENT/hackatdac21/blob/main/piton/design/chip/tile/ariane/src/rand_num/rng_16.v#L12-L22
Pengajuan
| Nama | Organisasi | Tanggal | Tanggal rilis | Version |
|---|---|---|---|---|
| Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi | Intel Corporation | 4.0 |
Modifikasi
| Nama | Organisasi | Tanggal | Komentar |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Modes_of_Introduction | |
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Modes_of_Introduction, Potential_Mitigations, Related_Attack_Patterns, Research_Gaps | |
| CWE Content Team | MITRE | updated Maintenance_Notes, Research_Gaps | |
| CWE Content Team | MITRE | updated Maintenance_Notes | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Observed_Examples, References | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description, Potential_Mitigations, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Potential_Mitigations |
