A PRNG is initialized from a predictable seed, e.g. using process ID or system time.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Other
Technical Impact: Varies by context
Demonstrative Examples
Example 1
In the code snippet below, a statistical PRNG is seeded with the
current value of the system clock, which is easily guessable.
(Bad Code)
Example
Language: Java
Random random = new Random(System.currentTimeMillis());
int accountID = random.nextInt();
Potential Mitigations
Use non-predictable inputs for seed generation.
Phases: Architecture and Design; Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [R.337.1] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Phase: Implementation
Consider a PRNG which re-seeds itself, as needed from a high quality
pseudo-random output, like hardware devices.
Description
