14 lines
761 B
Plaintext
14 lines
761 B
Plaintext
=== is related to: S2245
|
|
|
|
=== on 22 Oct 2020, 10:37:32 Alexandre Gigleux wrote:
|
|
This rule should be made more generic and at minimum be supported by C#.
|
|
|
|
I would rename it "Pseudo-Random Number Generator (PRNG) seeds should not be predictable".
|
|
|
|
|
|
The test cases from the SARD Juliet Suite (\https://samate.nist.gov/SARD/testsuite.php) should be used as a reference to know what should be detected or not: CWE336_Same_Seed_in_PRNG
|
|
|
|
=== on 3 Nov 2020, 11:31:26 Pavel Mikula wrote:
|
|
This rule is not relevant for .NET. ``++System.Random++`` can have seed, but should not be used for cryptography as RSPEC-2245 defines. Security-related APIs like ``++RandomNumberGenerator++`` or ``++RNGCryptoServiceProvider++`` don't have a way to set seed (for obvious reasons).
|
|
|