Skip to content

Commit 6423f1e

Browse files
BartyBoi1128s19110
andauthored
Update docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330/README.md
Co-authored-by: Hubert Daniszewski <[email protected]> Signed-off-by: BartyBoi1128 <[email protected]>
1 parent 514e188 commit 6423f1e

File tree

1 file changed

+2
-1
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330

1 file changed

+2
-1
lines changed

docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ Certain algorithms can create sequences of numbers that approximate random distr
77
PRNGs suitable for encryption must mix non-computational sources such as a mouse, keyboard, or even Lava Lamps [LavaRnd] to be random enough for encryption.
88

99
Python's random module is a standard library module that provides functions to generate pseudorandom numbers for various distributions. This module can lead to a vulnerability due to its predictability. The random module is based on the Mersenne Twister `MT19937`
10-
[[MATSUMOTO, NISHIMURA 1998](https://dl.acm.org/doi/pdf/10.1145/272991.272995)], which is a deterministic algorithm, that, given a particular input, will always produce the same output [[Wikipedia 2024](https://en.wikipedia.org/wiki/Deterministic_algorithm)]. An attacker knowing or can guessing the seed value can predict the entire sequence of the pseudorandom numbers. This also means that if two Random class objects are created using an identical seed, they will generate the same sequence of numbers, regardless of the Python environment.
10+
[[MATSUMOTO, NISHIMURA 1998](https://dl.acm.org/doi/pdf/10.1145/272991.272995)], which is a deterministic algorithm, that, given a particular input, will always produce the same output [[Wikipedia 2024](https://en.wikipedia.org/wiki/Deterministic_algorithm)]. An attacker knowing or guessing the seed value can predict the entire sequence of the pseudorandom numbers. This also means that if two `Random` class objects are created using an identical seed, they will generate the same sequence of numbers, regardless of the Python environment.
11+
1112

1213
Therefore, the random module is unsuitable for applications requiring high security as it does not incorporate cryptographic randomness, which means it is not resistant to reverse engineering. Its limited entropy makes it easier for attackers to deduce the internal state of the generator and predict future outputs.
1314

0 commit comments

Comments
 (0)