Usage of insufficient random number generator
ID |
c.cryptography.insecure_random |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
C / C++ |
Description
The $FUNC function is not cryptographically secure for generating random numbers used in keys, nonces, or other security-sensitive contexts. Use libsodium’s randombytes_random, or OpenSSL’s RAND_bytes family with FIPS mode if required.
Rationale
The $FUNC function is not cryptographically secure for generating random numbers used in keys, nonces, or other security-sensitive contexts. Use libsodium’s randombytes_random, or OpenSSL’s RAND_bytes family with FIPS mode if required.
The following code illustrates a vulnerable pattern detected by this rule:
int generate_encryption_key() {
short example[4];
int i;
// VULNERABLE: Usage of insufficient random number generator
short * seed48(short * );
char * str = (char * ) malloc(sizeof(char) * 11);
char * ptr;
// VULNERABLE: Usage of insufficient random number generator
double a = drand48();
// VULNERABLE: Usage of insufficient random number generator
double b = erand48(example);
// VULNERABLE: Usage of insufficient random number generator
long b = jrand48(example);
// VULNERABLE: Usage of insufficient random number generator
void lcong48();
// VULNERABLE: Usage of insufficient random number generator
lcong48(example);
// VULNERABLE: Usage of insufficient random number generator
long d = lrand48();
// VULNERABLE: Usage of insufficient random number generator
long z = mrand48();
// VULNERABLE: Usage of insufficient random number generator
long t = nrand48(example);
// VULNERABLE: Usage of insufficient random number generator
srand(time(0));
for (int i = 0; i < 2; i++)
printf(" %d ", rand());
// VULNERABLE: Usage of insufficient random number generator
oldptr = seed48(newseed);
for (i = 0; i < 10; i++) {
// VULNERABLE: Usage of insufficient random number generator
ptr = (char * ) strfry(str);
printf("Random numbers are: #%d: %s\n", i, ptr);
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.