Skip to content

Commit 96107ef

Browse files
Update docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330/README.md
Co-authored-by: David A. Wheeler <[email protected]> Signed-off-by: BartyBoi1128 <[email protected]>
1 parent c6386a9 commit 96107ef

File tree

1 file changed

+2
-1
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330

1 file changed

+2
-1
lines changed

docs/Secure-Coding-Guide-for-Python/CWE-693/CWE-330/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ PRNGs suitable for encryption must mix non-computational sources such as a mouse
99
Python's `random` module is a standard library module that provides functions to generate pseudorandom numbers for various distributions. This module can lead to a vulnerability due to its predictability. The random module is based on the Mersenne Twister `MT19937`
1010
[[MATSUMOTO, NISHIMURA 1998](https://dl.acm.org/doi/pdf/10.1145/272991.272995)], which is a deterministic algorithm, that, given a particular input, will always produce the same output [[Wikipedia 2024](https://en.wikipedia.org/wiki/Deterministic_algorithm)]. An attacker knowing or guessing the seed value can predict the entire sequence of the pseudorandom numbers. This also means that if two `Random` class objects are created using an identical seed, they will generate the same sequence of numbers, regardless of the Python environment.
1111

12-
Therefore, the `random` module is unsuitable for applications requiring high security as it does not incorporate cryptographic randomness, which means it is not resistant to reverse engineering. Its limited entropy makes it easier for attackers to deduce the internal state of the generator and predict future outputs.
12+
Therefore, the `random` module is unsuitable for applications requiring security as it does not incorporate cryptographic randomness, which means it is predictable. Its use makes it easy for attackers to deduce the internal state of the generator and predict future outputs.
13+
1314

1415
Instead, for generating random numbers, it is recommended to use a more robust option, such as Python's `secrets` module.
1516

0 commit comments

Comments
 (0)