include::../description.adoc[]

include::../ask-yourself.adoc[]

== Recommended Secure Coding Practices

* Use functions which rely on a cryptographically secure pseudorandom number generator (CSPRNG) such as ``++randombytes_uniform()++`` or ``++randombytes_buf()++`` from ``++libsodium++``, or ``++randomize()++`` from Botan.
* Use the generated random values only once.
* You should not expose the generated random value. If you have to store it, make sure that the database or file is secure.

== Sensitive Code Example

----
#include <random>
// ...

void f() {
  int random_int = std::rand(); // Sensitive
}
----

== Compliant Solution

[source,cpp]
----
#include <sodium.h>
#include <botan/system_rng.h>
// ...

void f() {
  char random_chars[10];    
  randombytes_buf(random_chars, 10);
  uint32_t random_int = randombytes_uniform(10);

  uint8_t random_chars[10];
  Botan::System_RNG system;
  system.randomize(random_chars, 10);
}
----

include::../see.adoc[]

* https://wiki.sei.cmu.edu/confluence/x/UNcxBQ[CERT, MSC30-C.] - Do not use the rand() function for generating pseudorandom numbers
* https://wiki.sei.cmu.edu/confluence/x/2ns-BQ[CERT, MSC50-CPP.] - Do not use std::rand() for generating pseudorandom numbers
* Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#PREDICTABLE_RANDOM[Predictable Pseudo Random Number Generator]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]
