CWE-333

Improper Handling of Insufficient Entropy in TRNG
AI Translation Available

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Status
draft
Abstraction
variant
Likelihood
low

The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.

Common Consequences

availability
Impacts
dos: crash, exit, or restart

Potential Mitigations

Phases:
implementation
Descriptions:
• Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.