CWE Rule 335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Since R2023a

Description

Rule Description

The software uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Polyspace Implementation

The rule checker checks for these issues:

• Deterministic random output from constant seed

• Predictable random output from predictable seed

Examples

Deterministic random output from constant seed

Issue

This issue occurs when you use standard random number generator functions that have deterministic output given a constant seed.

The checker detects this issue with the following random number generator functions:

• C Standard Library functions such as srand, srandom and initstate

• OpenSSL functions such as RAND_seed and RAND_add

• C++ Standard Library functions such as std::linear_congruential_engine<>::seed() and std::mersenne_twister_engine<>::seed() (and also the constructors of these class templates)

Risk

With constant seeds, random number generator functions produce the same output every time your program is run. A hacker can disrupt your program if they know how your program behaves.

Fix

Use a different random standard function or use a nonconstant seed.

Some standard random routines are inherently cryptographically weak, and should not be used for security purposes.

Example — Random Number Generator Initialization

#include <stdlib.h>

void random_num(void)
{
    srand(12345U);  //Noncompliant
    /* ... */
}

This example initializes a random number generator using srand with a constant seed. The random number generation is deterministic, making this function cryptographically weak.

Correction — Use Different Random Number Generator

One possible correction is to use a random number generator that does not require a seed. This example uses rand_s.

#define _CRT_RAND_S
#include <stdlib.h>
#include <stdio.h>

unsigned int random_num_time(void)
{

    unsigned int number;
    errno_t err;
    err = rand_s(&number);

    if(err != 0)
    {
        return number;
    }
    else
    {
        return err;
    }
}

Predictable random output from predictable seed

Issue

This issue occurs when you use standard random number generator functions with a nonconstant but predictable seed. Examples of predictable seed generators are time, gettimeofday, and getpid.

The checker detects this issue with the following random number generator functions:

• C Standard Library functions such as srand, srandom and initstate

• C++ Standard Library functions such as std::linear_congruential_engine<>::seed() and std::mersenne_twister_engine<>::seed() (and also the constructors of these class templates)

Risk

When you use predictable seed values for random number generation, your random numbers are also predictable. A hacker can disrupt your program if they know how your program behaves.

Fix

You can use a different function to generate less predictable seeds.

You can also use a different random number generator that does not require a seed. For example, the Windows^® API function rand_s seeds itself by default. It uses information from the entire system, for example, system time, thread ids, system counter, and memory clusters. This information is more random and a user cannot access this information.

Some standard random routines are inherently cryptographically weak, and should not be used for security purposes.

Example — Seed as an Argument

#include <stdlib.h>
#include <time.h>

void seed_rng(int seed)
{
    srand(seed); //Noncompliant
}

int generate_num(void)
{
    seed_rng(time(NULL) + 3);
    /* ... */
}

This example uses srand to start the random number generator with seed as the seed. However, seed is predictable because the function time generates it. So, an attacker can predict the random numbers generated by srand.

Correction — Use Different Random Number Generator

One possible correction is to use a random number generator that does not require a seed. This example uses rand_s.

#define _CRT_RAND_S

#include <stdlib.h>
#include <stdio.h>
#include <errno.h>

int generate_num(void)
{
    unsigned int number;
    errno_t err;
    err = rand_s(&number);

    if(err != 0)
    {
        return number;
    }
    else
    {
        return err;
    }
}

Check Information

Category: Random Number Issues

Version History

Introduced in R2023a