MISC.CRYPTO.SEED : Default Seed in PRNG

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.2p0

CONFIDENTIAL

CodeSecure Inc

MISC.CRYPTO.SEED : Default Seed in PRNG

要旨

プロパティ

AUTOSARC++14

AUTOSARC++14:A26-5-2

Random number engines shall not be default-initialized.

CWE

CWE:332

Insufficient Entropy in PRNG

CWE:335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

CWE:337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

CWE:676

Use of Potentially Dangerous Function

CERT-C

CERT-C:MSC32-C

Properly seed pseudorandom number generators

CERT-CPP

CERT-CPP:MSC51-CPP

Ensure your random number generator is properly seeded

DISA-6r1

DISA-6r1:V-222397

The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.

DISA-5r3

DISA-5r3:V-69259

The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.

DISA-4r3

DISA-4r3:V-69259

The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.

DISA-3r10

DISA-3r10:V-6137

The designer will ensure the application uses the Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and random number generator if the application implements encryption, key exchange, digital signature, and hash functionality.

例

#include <stdlib.h>

unsigned int get_high_entropy_seed(void);

long generate_randomness(void)
{
    long result;
    result = random(); /* 'Default Seed in PRNG' issued here */

    srandom(get_high_entropy_seed()); 
    result += random(); /* No warning here */
    return result;
}

int main(int argc, char *argv[])
{
    long r = generate_randomness();
    return r > 0;
}

解決法

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。