Ubiq Blog

Exploring CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The OWASP Top Ten list is a preeminent resource for application security. It describes the ten most common and impactful vulnerabilities that affect web applications today. In the latest version of the OWASP Top Ten list, Cryptographic Failures took the number two spot. This vulnerability describes the numerous ways in which cryptographic code could be used in ways that undermine its security. Among these issues is the incorrect usage of cryptographic seeds for a pseudorandom number generator (PRNG), which is tracked as CWE 335. This issue makes it possible for an attacker to derive cryptographic keys and other sensitive values based on knowledge of the seed value.