CWE-333 — Improper Handling of Insufficient Entropy in TRNG
CWE-333: Improper Handling of Insufficient Entropy in TRNG
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | Low |
Description
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
Common consequences
- Availability: DoS: Crash, Exit, or Restart
Mitigations
Implementation — Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
References
- CWE page: https://cwe.mitre.org/data/definitions/333.html
- CWE list: https://cwe.mitre.org/data/index.html