JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.
If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.
If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.
| CodeSonar® 9.2p0 | CONFIDENTIAL | CodeSecure Inc |
A pseudorandom number generator (PRNG) is passed a seed value derived from the system time.
The system time is not a strong random seed because it is predictable. An attacker who knows the approximate time that seeding took place and wants to reproduce the same sequence of pseudorandom numbers will have a relatively small number of candidate seeds to explore.
See also Hardcoded Seed in PRNG.
| Class Name | Predictable Seed in PRNG | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Significance | security | ||||||||||||||||||
| Mnemonic | MISC.CRYPTO.TIMESEED | ||||||||||||||||||
| Categories |
|
||||||||||||||||||
| Availability | Available for C and C++. |
||||||||||||||||||
| Enabling | Checks for this warning class are enabled by
default. To disable them, add the following WARNING_FILTER rule to the
project configuration file.
WARNING_FILTER += discard class="Predictable Seed in PRNG" |
#include <stdlib.h> #include <stdio.h> #include <time.h> unsigned int good_random_seed(void); /* Returns a strong random seed that cannot be predicted from system time. */ void test_predictable_seed(void){ int i; srand(5); /* Not based on system time, but hardcoded: Hardcoded Seed in PRNG warning issued here */ for (i = 0; i<10; i++){ printf("%d\n", rand()); /* The same sequence of 10 numbers is printed here every time test_predictable_seed() is called. */ } srand(time(NULL)); /* 'Predictable Seed in PRNG' warning issued here */ /* Depending on your time.h implementation, there may also be a Coercion Alters Value warning: * this call coerces the time_t returned by time() to unsigned int. */ for (i = 0; i<10; i++){ printf("%d\n", rand()); /* An attacker who knows the approximate date and time of execution has a relatively * small space of seeds to explore, and so a relatively small set of candidate sequences. */ } srand(good_random_seed()); /* ok: seed is not time-derived (or hardcoded) */ for (i = 0; i<10; i++){ printf("%d\n", rand()); } }
The following configuration file parameters affect checks for this warning class.
To report problems with this documentation, please visit https://support.codesecure.com/.