A PRNG uses the same seed each time the product is initialized. If an attacker can guess (or knows) the seed, then he/she may be able to determine the "random" number produced from the PRNG.
The following Java code uses the same seed value for a statistical
PRNG on every invocation.
(Bad Code)
Example
Language: Java
private static final long SEED = 1234567890;
public int generateAccountID() {
Random random = new Random(SEED);
return random.nextInt();
}
Potential Mitigations
Phase: Architecture and Design
Do not reuse PRNG seeds. Consider a PRNG that periodically re-seeds
itself as needed from a high quality pseudo-random output, such as
hardware devices.
Phases: Architecture and Design; Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [R.336.1] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Description
