CWE-341
Predictable from Observable State
AI Translation Available
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
Status
draft
Abstraction
base
Affected Platforms
Technical Details
AI Translation
Common Consequences
other
Impacts
varies by context
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
architecture and design
requirements
Descriptions:
•
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
•
Increase the entropy used to seed a PRNG.
•
Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.