The usage of an insecure pseudo-random number generator for security purposes is dangerous as it can make passwords, API keys, or other secrets guessable. While random number generators serve various purposes, not all generators or their usage are suitable for security.

For instance, a generator requires a strong seed for initialization; otherwise, the sequence of random numbers can be guessed.

Remediation

• Use a Pseudo-Random Number Generator (PRNG) with a strong random seed.
• Utilize hardware-based PRNGs.

Metadata

• Severity: medium
• Slug: insecure-random-number-generator

CWEs

• 338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• 337: Predictable Seed in Pseudo-Random Number Generator (PRNG)

OWASP

• A02:2021: Cryptographic Failures