The software uses an algorithm or scheme that produces
insufficient entropy, leaving patterns or clusters of values that are more
likely to occur than others.
Insufficiently random data used to generate
session tokens using C rand(). Also, for certificate/key generation, uses a
source that does not block when entropy is
low.
Potential Mitigations
Phase
Description
Determine the necessary entropy to adequately provide for randomness
and predictability. This can be achieved by increasing the number of
bits of objects such as keys and seeds.
Description
