cwe-330-weak-prng

To fix CWE-330 weak random number generation in Java, replace insecure random number generators like java.util.Random or Math.random() with java.security.SecureRandom. This ensures sufficient entropy and avoids predictable seeding for generating security-sensitive values.

You must use SecureRandom instead of Math.random in Java when generating security-sensitive values like session tokens, CSRF tokens, or API keys. SecureRandom provides the cryptographic entropy required to prevent predictable random value vulnerabilities.

Using java.util.Random creates a weak PRNG vulnerability because it relies on predictable seeding algorithms and lacks cryptographic entropy. This predictability allows attackers to guess generated values, compromising session tokens and API keys.

Yes, you can automatically remediate predictable random values flagged by SAST tools by applying targeted updates. This process identifies insecure Java random generation contexts and directly replaces them with java.security.SecureRandom for enhanced cryptographic security.

The best way to generate secure session tokens in Java is utilizing java.security.SecureRandom. It guarantees sufficient entropy during generation, ensuring your session tokens, CSRF tokens, and API keys remain cryptographically secure against prediction attacks.

A key limitation when replacing java.util.Random with SecureRandom for API keys is potential performance overhead. SecureRandom relies on system entropy sources, which can slow down generation compared to standard PRNGs, requiring careful implementation in high-throughput environments.