Uniform distribution in random numbers
Summary
The system's random numbers must be generated using a uniform distribution.
Description
The system's cryptographic keys are essential for maintaining the confidentiality and integrity of transactions and communications. Some of these keys and other critical elements are generated using random numbers. In these cases, the random numbers themselves must be generated using secure mechanisms that guarantee a random distribution.
References
- CAPEC-20. Encryption brute forcing
- CWE-330. Use of insufficiently random values
- CWE-331. Insufficient entropy
- CWE-334. Small space of random values
- CWE-340. Generation of predictable numbers or identifiers
- OWASP10-A8. Software and data integrity failures
- OWASPM10-M3. Insecure communication threat agents
- CERTC-MSC32-C. Properly seed pseudorandom number generators
- CERTJ-MSC02-J. Generate strong random numbers
- HITRUST-09_y. On-line transactions
- HITRUST-10_g. Key management
- ISO27002-8_24. Use of cryptography
- WASSEC-6_2_2_5. Authorization - Session weaknesses
- OWASPSCP-6. Cryptographic practices
- ASVS-2_6_2. Look-up secret verifier
- ASVS-2_7_6. Out of band verifier
- ASVS-6_2_4. Algorithms
- ASVS-6_3_1. Random values
- ASVS-6_3_3. Random values
- ASVS-6_3_2. Random values
- ISO27001-8_24. Use of cryptography
- CASA-2_7_6. Out of Band Verifier
- CASA-6_2_4. Algorithms
- CASA-6_3_1. Random Values
- CASA-6_3_2. Random Values
- CASA-6_3_3. Random Values
Weaknesses
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan.If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.
Supported In
This requirement is verified in following services
Essential Plan
Advanced Plan