Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random.
The C Standard
rand() function makes no guarantees as to the quality of the random sequence produced. The numbers generated by some implementations of
rand() have a comparatively short cycle and the numbers can be predictable. Applications that have strong pseudorandom number requirements must use a generator that is known to be sufficient for their needs.
Noncompliant Code Example
The following noncompliant code generates an ID with a numeric part produced by calling the
rand() function. The IDs produced are predictable and have limited randomness.
Compliant Solution (POSIX)
This compliant solution replaces the
rand() function with the POSIX
random() function is a better pseudorandom number generator. Although on some platforms the low dozen bits generated by
rand() go through a cyclic pattern, all the bits generated by
random() are usable. The
rand48 family of functions provides another alternative for pseudorandom numbers.
... provides higher quality of data than those described in rand(3), random(3), and drand48(3).
To achieve the best random numbers possible, an implementation-specific function must be used. When unpredictability is crucial and speed is not an issue, as in the creation of strong cryptographic keys, use a true entropy source, such as
/dev/random, or a hardware device capable of generating random numbers. The
/dev/random device can block for a long time if there are not enough events going on to generate sufficient entropy.
Compliant Solution (Windows)
The default random number provider implements an algorithm for generating random numbers that complies with the NIST SP800-90 standard, specifically the CTR_DRBG portion of that standard.
The use of the
rand() function can result in predictable random numbers.
|Axivion Bauhaus Suite|
|Checked by |
|BADFUNC.RANDOM.RAND||Use of rand|
|Implemented - weak support|
|LDRA tool suite|
|44 S||Enhanced enforcement|
|Do not use the rand() function for generating pseudorandom numbers|
|Polyspace Bug Finder|
|Vulnerable pseudo-random number generator|
Using a cryptographically weak pseudo-random number generator
Key here (explains table format and definitions)
|CERT C||MSC50-CPP. Do not use std::rand() for generating pseudorandom numbers||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT Oracle Secure Coding Standard for Java||MSC02-J. Generate strong random numbers||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CWE 2.11||CWE-327, Use of a Broken or Risky Cryptographic Algorithm||2017-05-16: CERT: Rule subset of CWE|
|CWE 2.11||CWE-330, Use of Insufficiently Random Values||2017-06-28: CERT: Rule subset of CWE|
|CWE 2.11||CWE-338, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)||2017-06-28: CERT: Rule subset of CWE|
|CWE 2.11||CWE-676||2017-05-18: CERT: Rule subset of CWE|
CERT-CWE Mapping Notes
Key here for mapping notes
CWE-327 and MSC30-C
- CWE-327 forbids “broken or risky cryptographic algorithms” but does not specify what constitutes such an algo.
- Per CERT judgement, rand() qualifies, so:
- CWE-327 = Union( MSC30-C, list) where list =
- Invocation of broken/risky crypto algorithms besides rand()
CWE-338 and MSC30-C
CWE-338 = Union( MSC30-C, list) where list =
- Use of a weak PRNG besides standard C rand().
CWE-330 and MSC30-C
Independent( MSC30-C, MSC32-C, CON33-C)
CWE-330 = Union( MSC30-C, MSC32-C, CON33-C, list) where list = other improper use or creation of random values. (EG the would qualify)
MSC30-C, MSC32-C and CON33-C are independent, they have no intersections. They each specify distinct errors regarding PRNGs.
CWE-676 and MSC30-C
- Independent( ENV33-C, CON33-C, STR31-C, EXP33-C, MSC30-C, ERR34-C)
- MSC30-C implies that rand() is dangerous.
- CWE-676 = Union( MSC30-C, list) where list =
- Invocation of other dangerous functions, besides rand().