JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
C and C++


MISC.CRYPTO.TIMESEED : Predictable Seed in PRNG

Summary

A pseudorandom number generator (PRNG) is passed a seed value derived from the system time.

The system time is not a strong random seed because it is predictable. An attacker who knows the approximate time that seeding took place and wants to reproduce the same sequence of pseudorandom numbers will have a relatively small number of candidate seeds to explore.

See also Hardcoded Seed in PRNG.

Properties

Class Name Predictable Seed in PRNG
Significance security
Mnemonic MISC.CRYPTO.TIMESEED
Categories
MisraC++2023 MisraC++2023:0.3.2 A function call shall not violate the function's preconditions
CWE CWE:337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
CERT-C CERT-C:MSC32-C Properly seed pseudorandom number generators
CERT-CPP CERT-CPP:MSC51-CPP Ensure your random number generator is properly seeded
OWASP-2021 OWASP-2021:A2 Cryptographic failures
OWASP-2025 OWASP-2025:A04 Cryptographic Failures
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Predictable Seed in PRNG"

Example

#include <stdlib.h>
#include <stdio.h>
#include <time.h>

unsigned int good_random_seed(void);                       /* Returns a strong random seed that cannot be predicted from system time. */

void test_predictable_seed(void){
    int i;
    srand(5);                     /* Not based on system time, but hardcoded: Hardcoded Seed in PRNG warning issued here */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());   /* The same sequence of 10 numbers is printed here every time test_predictable_seed() is called. */
    }

    srand(time(NULL));            /* 'Predictable Seed in PRNG' warning issued here */
                                  /* Depending on your time.h implementation, there may also be a Coercion Alters Value warning:
                                   * this call coerces the time_t returned by time() to unsigned int.
                                   */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());   /* An attacker who knows the approximate date and time of execution has a relatively
                                   * small space of seeds to explore, and so a relatively small set of candidate sequences.
                                   */
    }

    srand(good_random_seed());                         /* ok: seed is not time-derived (or hardcoded) */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());
    }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

 

To report problems with this documentation, please visit https://support.codesecure.com/.