CWE-334 (随机数的空间太小) — Vulnerability Class 11

CWE-334 represents a cryptographic weakness where the entropy of generated random values is insufficient for the intended security context. This deficiency arises when the algorithm’s output space is too small, often due to poor seeding or limited bit-width, rendering the values predictable. Attackers typically exploit this by performing brute-force or statistical analysis attacks to guess the correct value, thereby bypassing authentication mechanisms, session identifiers, or cryptographic keys. To mitigate this risk, developers must employ cryptographically secure pseudo-random number generators (CSPRNGs) that provide adequate entropy. It is crucial to ensure that the random number generator is properly seeded with high-entropy sources and that the resulting values meet the minimum length requirements specified by current cryptographic standards, ensuring resistance against exhaustive search attempts.