JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
C and C++


MISC.CRYPTO.TIMESEED : Predictable Seed in PRNG

要旨

A pseudorandom number generator (PRNG) is passed a seed value derived from the system time.

The system time is not a strong random seed because it is predictable. An attacker who knows the approximate time that seeding took place and wants to reproduce the same sequence of pseudorandom numbers will have a relatively small number of candidate seeds to explore.

See also Hardcoded Seed in PRNG.

プロパティ

クラス名 Predictable Seed in PRNG
日本語クラス名 Predictable Seed in PRNG
クラス分類 セキュリティ (security)
ニーモニック MISC.CRYPTO.TIMESEED
カテゴリー
MisraC++2023 MisraC++2023:0.3.2 A function call shall not violate the function's preconditions
CWE CWE:337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
CERT-C CERT-C:MSC32-C Properly seed pseudorandom number generators
CERT-CPP CERT-CPP:MSC51-CPP Ensure your random number generator is properly seeded
OWASP-2021 OWASP-2021:A2 Cryptographic failures
OWASP-2025 OWASP-2025:A04 Cryptographic Failures
対応言語 C および C++ で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル (configuration file)に以下の WARNING_FILTER ルールを追加してください。
WARNING_FILTER += discard class="Predictable Seed in PRNG"

#include <stdlib.h>
#include <stdio.h>
#include <time.h>

unsigned int good_random_seed(void);                       /* Returns a strong random seed that cannot be predicted from system time. */

void test_predictable_seed(void){
    int i;
    srand(5);                     /* Not based on system time, but hardcoded: Hardcoded Seed in PRNG warning issued here */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());   /* The same sequence of 10 numbers is printed here every time test_predictable_seed() is called. */
    }

    srand(time(NULL));            /* 'Predictable Seed in PRNG' warning issued here */
                                  /* Depending on your time.h implementation, there may also be a Coercion Alters Value warning:
                                   * this call coerces the time_t returned by time() to unsigned int.
                                   */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());   /* An attacker who knows the approximate date and time of execution has a relatively
                                   * small space of seeds to explore, and so a relatively small set of candidate sequences.
                                   */
    }

    srand(good_random_seed());                         /* ok: seed is not time-derived (or hardcoded) */
    for (i = 0; i<10; i++){
        printf("%d\n", rand());
    }
}

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

 

To report problems with this documentation, please visit https://support.codesecure.com/.