CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-331: Insufficient Entropy

Individual Definition in a New Window
Insufficient Entropy
Status: Draft
Weakness ID: 331 (Weakness Base)
+ Description
Summary

The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

+ Time of Introduction
* Architecture and Design
* Implementation
+ Applicable Platforms
Languages
All
+ Observed Examples
ReferenceDescription
Insufficiently random data used to generate session tokens using C rand(). Also, for certificate/key generation, uses a source that does not block when entropy is low.
+ Potential Mitigations

Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class330Use of Insufficiently Random Values
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness VariantWeakness Variant332Insufficient Entropy in PRNG
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness VariantWeakness Variant333Improper Handling of Insufficient Entropy in TRNG
Development Concepts (primary)699
Research Concepts (primary)1000
+ Taxonomy Mappings
Mapped Taxonomy NameMapped Node Name
PLOVERInsufficient Entropy
+ References
J. Viega and G. McGraw. "Building Secure Software: How to Avoid Security Problems the Right Way". 2002.
+ Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Relationships, Taxonomy_Mappings
Back to top
Page Last Updated: May 26, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us