Skip to main content

Insecure generation of random numbers

Need​

Secure generation of random numbers

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of rand for generating random numbers or values

Description​

Non compliant code​

public function generateRandomNumber() {
    return rand();
}

The above code snippet shows a function generateRandomNumber() which is using PHP's built-in rand() function to generate random numbers.

The rand() function is not suitable for generating cryptographically secure random numbers. It uses a pseudo-random number generator that can be easily predicted, especially if the seed is known or can be guessed. Moreover, it does not provide a sufficient range or high entropy components, making the generated number susceptible to probabilistic methods of attack.

In a backend application, such insecure generation of random numbers can lead to serious security issues. For example, if this function is used to generate session IDs, tokens, or any other sensitive data, an attacker could potentially predict these values, leading to unauthorized access or other forms of attacks.

Steps​

  • Replace the insecure random number generation function with a secure one. In PHP, you can use the 'random_int' or 'openssl_random_pseudo_bytes' functions, which are cryptographically secure.
  • Define a range for the random number generation. Without a defined range, the function could potentially return very large or very small numbers, which might not be suitable for your application.
  • Ensure that the random number generator is properly seeded. If the generator is not properly seeded, it could produce predictable numbers, which would be a security risk.
  • Consider using a library or module that is specifically designed for secure random number generation. These libraries have been thoroughly tested and are less likely to have vulnerabilities.
  • Regularly update and patch your random number generation function or library to ensure it remains secure against new threats and vulnerabilities.

Compliant code​

public function generateRandomNumber() {
    return random_int(PHP_INT_MIN, PHP_INT_MAX);
}

The original code was using the rand() function to generate random numbers, which is not secure. The rand() function is not cryptographically secure, meaning that the numbers it generates can be predicted if an attacker can guess the seed value.

The updated code uses the random_int() function instead. This function is cryptographically secure, meaning that it is suitable for generating random numbers in a security context. The random_int() function generates a random integer within the provided range, in this case between the minimum and maximum values for an integer in PHP (PHP_INT_MIN and PHP_INT_MAX).

This change makes the random number generation more secure and less predictable, reducing the risk of an attacker being able to guess the generated numbers.

Remember to handle exceptions that may be thrown by random_int() in case it cannot generate a secure random integer.

Also, it's important to note that the range of generated numbers should be adjusted according to the specific needs of your application. The provided range is just an example and might not be suitable for all use cases.

References​

Last updated on