WebOTG-CR-004 — Cryptographically Secure Pseudorandom Number Generation

1. Executive Summary & Scope

Standard random number functions (such as PHP's `rand()`, `mt_rand()`, or JavaScript's `Math.random()`) are non-cryptographic and rely on predictable linear feedback shift registers or Mersenne Twister algorithms. If used to generate session IDs, password reset tokens, or API keys, an attacker can calculate past and future outputs after observing a few outputs.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-330 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

An attacker requests a password reset token for their own account, determines the internal PRNG state, and predicts the reset token generated milliseconds later for the administrator account.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: Predictable random generator used for security token $resetToken = md5(mt_rand() . time()); // Insecure: mt_rand is fully predictable $csrfToken = uniqid("csrf_", true); // Insecure: uniqid is based on system clock

Hardened Defense-in-Depth Implementation

// REMEDIATED: Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) // Generate 32 bytes (256 bits) of cryptographic entropy $randomBytes = random_bytes(32); $resetToken = bin2hex($randomBytes); // For integer ranges (e.g. 6-digit MFA token) $mfaCode = str_pad((string)random_int(100000, 999999), 6, '0', STR_PAD_LEFT);

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Static Analysis Code Grep	Search codebase for occurrences of `mt_rand(`, `rand(`, `uniqid(`, `Math.random()`.	Zero non-cryptographic generators used in security-sensitive contexts.
Token Entropy Testing	Sample 100,000 generated tokens using statistical randomness tests (NIST SP 800-22).	Tokens exhibit maximum Shannon entropy with zero correlation.
Kernel Entropy Source Verification	Verify server operating system provides healthy `/dev/urandom` entropy pool.	System returns cryptographic random bytes without blocking.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.