Insufficient Entropy

Opis

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Skutki

• Access Control, Other

  Bypass Protection Mechanism; Other

  An attacker could guess the random numbers generated and could gain unauthorized access to a system if the random numbers are used for authentication and authorization.

Zapobieganie

• Implementation

  Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Przykłady podatności

• CVE-2001-0950 Insufficiently random data used to generate session tokens using C rand(). Also, for certificate/key generation, uses a source that does not block when entropy is low.
• CVE-2008-2108 Chain: insufficient precision (CWE-1339) in random-number generator causes some zero bits to be reliably generated, reducing the amount of entropy (CWE-331)

Słabość nadrzędna

• CWE-330 Use of Insufficiently Random Values

Słabości podrzędne

• CWE-332 Insufficient Entropy in PRNG
• CWE-333 Improper Handling of Insufficient Entropy in TRNG

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely. Within the developer and other communities, "randomness" is used heavily. However, within cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonly-used definitions, even within standards documents and cryptography papers. Future versions of CWE will attempt to define these terms and, if necessary, distinguish between them in ways that are appropriate for different communities but do not reduce the usability of CWE for mapping, understanding, or other scenarios.

Źródła

1. Building Secure Software: How to Avoid Security Problems the Right Way — John Viega, Gary McGraw, Addison-Wesley, 2002