Skip to main content

Insecure generation of random numbers

Need​

Secure generation of random numbers

Context​

  • Usage of C# for developing robust and efficient software applications
  • Usage of System for accessing and manipulating system-level functionality

Description​

Non compliant code​

public class RandomNumberGenerator
{
    public int GenerateRandomNumber()
    {
        Random random = new Random();
        return random.Next();
    }
}

The above C# code is vulnerable to attacks due to insecure generation of random numbers. The System.Random class in .NET is not designed to generate secure random numbers. It uses a mathematical algorithm to generate a sequence of numbers that appear random. However, if an attacker can predict the seed value that System.Random is initialized with, they can predict the sequence of numbers that will be generated.

In the GenerateRandomNumber method, a new instance of Random is created each time the method is called. This could potentially lead to predictability in the random numbers, especially if the method is called in quick succession. The Random class in .NET is initialized with a time-dependent seed value, so if two Random objects are created within the same tick of the system clock, they will generate identical sequences of random numbers.

This could be exploited by an attacker to predict the random numbers generated by the application, potentially leading to serious security issues, for example, in scenarios where these numbers are used for session tokens, password reset tokens, or any form of sensitive data.

Steps​

  • Replace the usage of the System.Random class with a cryptographically secure random number generator.
  • Use a secure random number generator that provides a higher level of entropy.
  • Ensure that the random number generator is properly seeded with a secure source of randomness.
  • Consider using a library or framework that provides a secure random number generation functionality.
  • Regularly update the random number generator implementation to stay up-to-date with the latest security standards.

Compliant code​

using System.Security.Cryptography;

public class SecureRandomNumberGenerator
{
    public int GenerateRandomNumber()
    {
        using (RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider())
        {
            byte[] randomNumber = new byte[4]; //4 bytes will give us an integer
            rng.GetBytes(randomNumber);
            int value = BitConverter.ToInt32(randomNumber, 0);
            return value;
        }
    }
}

The previous implementation of the random number generator was insecure because it used the System.Random class, which is not cryptographically secure. The sequence of random numbers it generates can be predicted after a short time, which is a security vulnerability.

The new implementation uses the RNGCryptoServiceProvider class from the System.Security.Cryptography namespace, which is a cryptographically secure random number generator. This class provides a higher level of entropy, making the generated numbers more random and less predictable.

The RNGCryptoServiceProvider class is used within a using statement to ensure that the resources it uses are correctly disposed of when they are no longer needed. This is a good practice to prevent resource leaks.

The RNGCryptoServiceProvider.GetBytes method is used to fill an array of bytes with a cryptographically strong sequence of random values. The size of the array determines the range of the random numbers that can be generated. In this case, an array of 4 bytes is used, which allows for the generation of any integer value.

The BitConverter.ToInt32 method is then used to convert the array of bytes into an integer. This is the random number that is returned by the GenerateRandomNumber method.

This implementation is more secure than the previous one and should be less vulnerable to attacks. However, it is important to regularly update the implementation to stay up-to-date with the latest security standards.

References​

Last updated on