223 – Uniform distribution in random numbers

Summary

The system's random numbers must be generated using a uniform distribution.

Description

The system's cryptographic keys are essential for maintaining the confidentiality and integrity of transactions and communications. Some of these keys and other critical elements are generated using random numbers. In these cases, the random numbers themselves must be generated using secure mechanisms that guarantee a random distribution.

Supported In

Essential: True

Advanced: True

References

• CAPEC-20. Encryption brute forcing
• CWE-330. Use of insufficiently random values
• CWE-331. Insufficient entropy
• CWE-334. Small space of random values
• CWE-340. Generation of predictable numbers or identifiers
• OWASP10-A8. Software and data integrity failures
• OWASPM10-M3. Insecure communication threat agents
• CERTC-MSC32-C. Properly seed pseudorandom number generators
• CERTJ-MSC02-J. Generate strong random numbers
• HITRUST-09_y. On-line transactions
• HITRUST-10_g. Key management
• ISO27002-8_24. Use of cryptography
• WASSEC-6_2_2_5. Authorization - Session weaknesses
• OWASPSCP-6. Cryptographic practices
• ASVS-2_6_2. Look-up secret verifier
• ASVS-2_7_6. Out of band verifier
• ASVS-6_2_4. Algorithms
• ASVS-6_3_1. Random values
• ASVS-6_3_3. Random values
• ASVS-6_3_2. Random values
• ISO27001-8_24. Use of cryptography
• CASA-2_7_6. Out of Band Verifier
• CASA-6_2_4. Algorithms
• CASA-6_3_1. Random Values
• CASA-6_3_2. Random Values
• CASA-6_3_3. Random Values

Weaknesses

• 395 – Insecure generation of random numbers - Static IV
• 034 – Insecure generation of random numbers

Last updated

2023/09/18