thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Insecure Randomness

Using a predictable random number generator for security-sensitive values such as tokens, keys or nonces.

Definition

Functions like Math.random() or rand() are not cryptographically secure and can be predicted from observed outputs. Security values must use a CSPRNG such as SecureRandom, crypto.getRandomValues or the OS's /dev/urandom. Tracked as CWE-330/338.

Example

Password reset tokens generated with Math.random() can be predicted after observing a few tokens.

Exam tip

Use a CSPRNG; a common Cryptographic Failures example.

Related terms