COMMON WEAKNESS ENUMERATIONDraft

CWE-333

Improper Handling of Insufficient Entropy in TRNG

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Low

Understand the problem

What is the problem?

True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.

Extended description

The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Risk

What does successful exploitation lead to?

DoS: Crash, Exit, or Restart

Affected security scopes: Availability

A program may crash or block if it runs out of random numbers.

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.