CWE-333: Improper Handling of Insufficient Entropy in TRNG

Export to Word

Description

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Extended Description

The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.


ThreatScore

Threat Mapped score: 1.8

Industry: Finiancial

Threat priority: P4 - Informational (Low)


Observed Examples (CVEs)

Related Attack Patterns (CAPEC)

N/A


Attack TTPs

N/A

Modes of Introduction

Phase Note
Architecture and Design N/A
Implementation REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Common Consequences

Potential Mitigations

Applicable Platforms


Demonstrative Examples

Intro: This code uses a TRNG to generate a unique session id for new connections to a server:

Body: This code does not attempt to limit the number of new connections or make sure the TRNG can successfully generate a new random number. An attacker may be able to create many new connections and exhaust the entropy of the TRNG. The TRNG may then block and cause the program to crash or hang.

while (1){ if (haveNewConnection()){ if (hwRandom()){ int sessionID = hwRandom(); createNewConnection(sessionID); } } }

Notes

← Back to CWE list