TScaria621837 (Community Member) asked a question.
Fix - Insufficient Entropy (CWE ID 331)
Hi,
In our last scan ran on around 08th Aug 2021, we got new so many medium flaws (Insufficient Entropy (CWE ID 331)) in the application where ever we using random generator.
This is one of the sample line of code –
for (int i = 0; i < length; i++)
{
string character = string.Empty;
do
{
int index = new Random().Next(0, characters.Length); //This line shows the flaw
character = characters.ToCharArray()[index].ToString();
} while (otp.IndexOf(character) != -1);
otp += character;
}
Please suggest how to resolve these?
Thanks,
Jaisa
.png){kind=logo}
Hi @TScaria621837 (Community Member),
Thank you for asking this. I suspect the flaw has been raised due to the use of Random(). The Random class does not use a secure source of entropy for use in cryptographic operations. You may wish to consider the RNGCryptoServiceProvider (https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rngcryptoserviceprovider?view=net-5.0) if this randomness is to be used for cryptographic operations. From the snippet it looks to be potentially generating a passphrase, perhaps as part of a new user registration. If that is the case then we would instead recommend have the user supply a password rather than generate one for them. If the randomness is not used for cryptographic or security control operations then a mitigation by design would be an appropriate strategy here, documenting the reason why secure entropy is not required.
I hope that answers your question.
Thanks,
Anthony
We have a similar issue in Java as well, we are using SecureRandom (which is cryptographic strength algorithm).
Still we are getting this flaw as part of scan results, could you please suggest an alternative in Java?