CWE-332 - Insufficient Entropy in PRNG

CWE ID:

CWE-332

Medium

Abstraction:Variant
Structure:Simple
Status:Draft

Release Date:2006-07-19
Latest Modification Date:2024-02-29

Weakness Name

Insufficient Entropy in PRNG

Description

The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.

Common Consequences

Scope: Availability

Impact: DoS: Crash, Exit, or Restart

Notes: If a pseudo-random number generator is using a limited entropy source which runs out (if the generator fails closed), the program may pause or crash.

Scope: Access Control, Other

Impact: Bypass Protection Mechanism, Other

Notes: If a PRNG is using a limited entropy source which runs out, and the generator fails open, the generator could produce predictable random numbers. Potentially a weak source of random numbers could weaken the encryption method used for authentication of users.