CWE-1241: Use of Predictable Algorithm in Random Number Generator
Description
The device uses an algorithm that is predictable and generates a pseudo-random number.
Submission Date :
Feb. 10, 2020, midnight
Modification Date :
2023-10-26 00:00:00+00:00
Organization :
Intel Corporation
Extended Description
Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering. It is highly recommended to use hardware-based true random number generators (TRNGs) to ensure the security of encryption schemes. TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
Example - 1
Suppose a cryptographic function expects random value to be supplied for the crypto algorithm.
During the implementation phase, due to space constraint, a cryptographically secure random-number-generator could not be used, and instead of using a TRNG (True Random Number Generator), a LFSR (Linear Feedback Shift Register) is used to generate a random value. While an LFSR will provide a pseudo-random number, its entropy (measure of randomness) is insufficient for a cryptographic algorithm.
Example - 2
The example code is taken from the PRNG inside the buggy OpenPiton SoC of HACK@DAC'21 [REF-1370]. The SoC implements a pseudo-random number generator using a Linear Feedback Shift Register (LFSR).
<xhtml_b>reg in_sr, entropy16_valid;</xhtml_b>
<xhtml_b>reg [15:0] entropy16;</xhtml_b>
<xhtml_b>assign entropy16_o = entropy16;</xhtml_b>
<xhtml_b>assign entropy16_valid_o = entropy16_valid;</xhtml_b>
<xhtml_b>always @ (*)</xhtml_b>
<xhtml_b>begin</xhtml_b>
<xhtml_b>in_sr = ^ (poly_i [15:0] & entropy16 [15:0]);</xhtml_b>
<xhtml_b>end</xhtml_b>
A LFSR's input bit is determined by the output of a linear function of two or more of its previous states. Therefore, given a long cycle, a LFSR-based PRNG will enter a repeating cycle, which is predictable.
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.