CWE-333: Improper Handling of Insufficient Entropy in TRNG
Weakness ID: 333
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
Time of Introduction
Architecture and Design
Technical Impact: DoS: crash / exit /
A program may crash or block if it runs out of random numbers.
Likelihood of Exploit
Low to Medium
This code uses a TRNG to generate a unique session id for new
connections to a server:
int sessionID = hwRandom();
} } }
This code does not attempt to limit the number of new connections or
make sure the TRNG can successfully generate a new random number. An
attacker may be able to create many new connections and exhaust the
entropy of the TRNG. The TRNG may then block and cause the program to
crash or hang.
Rather than failing on a lack of random numbers, it is often
preferable to wait for more numbers to be created.