Use of an insecure pseudo-random number generator
ID |
vbnet.predictability.insecure_randomness |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Predictability |
Language |
VB.NET |
Description
Use of System.Random, an insecure pseudo-random number generator. Its output is predictable and must never be used to generate cryptographic keys, tokens, IVs, salts or any other security-sensitive value. Use System.Security.Cryptography.RandomNumberGenerator (RandomNumberGenerator.Create() or RandomNumberGenerator.Fill/GetBytes) instead.
Rationale
Use of System.Random, an insecure pseudo-random number generator. Its output is predictable and must never be used to generate cryptographic keys, tokens, IVs, salts or any other security-sensitive value. Use System.Security.Cryptography.RandomNumberGenerator (RandomNumberGenerator.Create() or RandomNumberGenerator.Fill/GetBytes) instead.
The following code illustrates a vulnerable pattern detected by this rule:
Public Function GenerateKey() As Byte()
' VULNERABLE: Use of an insecure pseudo-random number generator
Dim rng As New Random()
Dim key(31) As Byte
rng.NextBytes(key)
Return key
End Function