Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random.

The C Standard function rand() (available in stdlib.h) does not have good random number properties. The numbers generated by rand() have a comparatively short cycle, and the numbers can be predictable.

Noncompliant Code Example

The following code generates an ID with a numeric part produced by calling the rand() function. The IDs produced are predictable and have limited randomness.

enum {len = 12};
char id[len];  /* id will hold the ID, starting with
                * the characters "ID" followed by a
                * random integer */
int r;
int num;
/* ... */
r = rand();  /* generate a random integer */
num = snprintf(id, len, "ID%-d", r);  /* generate the ID */
/* ... */

Compliant Solution (POSIX)

A better pseudorandom number generator is the random() function. While the low dozen bits generated by rand() go through a cyclic pattern, all the bits generated by random() are usable.

enum {len = 12};
char id[len];  /* id will hold the ID, starting with
                * the characters "ID" followed by a
                * random integer */
int r;
int num;
/* ... */
time_t now = time(NULL);
if (now == (time_t) -1) {
  /* handle error */
}
srandom(now);  /* seed the PRNG with the current time */
/* ... */
r = random();  /* generate a random integer */
num = snprintf(id, len, "ID%-d", r);  /* generate the ID */
/* ... */

The rand48 family of functions provides another alternative for pseudorandom numbers.

Although not specified by POSIX, arc4random() is an option on systems that support it. From the arc4random(3) manual page

arc4random() fits into a middle ground not covered by other subsystems such as the strong, slow, and resource expensive random devices described in random(4) versus the fast but poor quality interfaces described in rand(3), random(3), and drand48(3).

To achieve the best random numbers possible, an implementation-specific function must be used. When unpredictability really matters and speed is not an issue, as in the creation of strong cryptographic keys, use a true entropy source, such as /dev/random or a hardware device capable of generating random numbers. Note that the /dev/random device can block for a long time if there are not enough events going on to generate sufficient entropy.

Compliant Solution (Windows)

On Windows platforms, the [{{CryptGenRandom()}}|http://msdn2.microsoft.com/en-us/library/aa379942.aspx] function can be used to generate cryptographically strong random numbers. Note that the exact details of the implementation are unknown, including, for example, what source of entropy {{CryptGenRandom()}} uses. From the Microsoft Developer Network {{CryptGenRandom()}} reference \[[MSDN|AA. Bibliography#MSDN]\]

If an application has access to a good random source, it can fill the {{pbBuffer}} buffer with some random data before calling {{CryptGenRandom()}}. The CSP \[cryptographic service provider\] then uses this data to further randomize its internal seed. It is acceptable to omit the step of initializing the {{pbBuffer}} buffer before calling {{CryptGenRandom()}}.

#include<Wincrypt.h>

HCRYPTPROV hCryptProv;
union {
    BYTE bs[sizeof(long int)];
    long int li;
} rand_buf;

if (!CryptGenRandom(hCryptProv, sizeof(rand_buf), &rand_buf) {
    /* Handle error */
} else {
    printf("Random number: %ld\n", rand_buf.li);
}

Risk Assessment

Using the rand() function leads to possibly predictable random numbers.

Automated Detection

Tool	Version	Checker	Description
LDRA tool suite
Fortify SCA	V. 5.0
Compass/ROSE
ECLAIR		stlibuse	Fully Implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: MSC30-CPP. Do not use the rand() function for generating pseudorandom numbers

The CERT Oracle Secure Coding Standard for Java: MSC02-J. Generate strong random numbers

ISO/IEC 9899:1999 Section 7.20.2.1, "The rand function"

MITRE CWE: CWE-327, "Use of a Broken or Risky Cryptographic Algorithm"

MITRE CWE: CWE-330, "Use of Insufficiently Random Values"

Bibliography

\[[MSDN|AA. Bibliography#MSDN]\] "[CryptGenRandom Function|http://msdn.microsoft.com/en-us/library/aa379942.aspx]"

      49. Miscellaneous (MSC)      MSC31-C. Ensure that return values are compared against the proper type