# MSC50-CPP: Do not use std::rand() for generating pseudorandom numbers

This query implements the CERT-C++ rule MSC50-CPP:

> Do not use std::rand() for generating pseudorandom numbers


## Description

Pseudorandom number generators use mathematical algorithms to produce a sequence of numbers with good statistical properties, but the numbers produced are not genuinely random.

The C Standard `rand()` function, exposed through the C++ standard library through `<cstdlib>` as `std::rand()`, makes no guarantees as to the quality of the random sequence produced. The numbers generated by some implementations of `std::rand()` have a comparatively short cycle, and the numbers can be predictable. Applications that have strong pseudorandom number requirements must use a generator that is known to be sufficient for their needs.

## Noncompliant Code Example

The following noncompliant code generates an ID with a numeric part produced by calling the `rand()` function. The IDs produced are predictable and have limited randomness. Further, depending on the value of `RAND_MAX`, the resulting value can have modulo bias.

```cpp
#include <cstdlib>
#include <string>
 
void f() {
  std::string id("ID"); // Holds the ID, starting with the characters "ID" followed
                        // by a random integer in the range [0-10000].
  id += std::to_string(std::rand() % 10000);
  // ...
}
```

## Compliant Solution

The C++ standard library provides mechanisms for fine-grained control over pseudorandom number generation. It breaks random number generation into two parts: one is the algorithm responsible for providing random values (the engine), and the other is responsible for distribution of the random values via a density function (the distribution). The distribution object is not strictly required, but it works to ensure that values are properly distributed within a given range instead of improperly distributed due to bias issues. This compliant solution uses the [Mersenne Twister](http://dl.acm.org/citation.cfm?doid=272991.272995) algorithm as the engine for generating random values and a uniform distribution to negate the modulo bias from the noncompliant code example.

```cpp
#include <random>
#include <string>
 
void f() {
  std::string id("ID"); // Holds the ID, starting with the characters "ID" followed
                        // by a random integer in the range [0-10000].
  std::uniform_int_distribution<int> distribution(0, 10000);
  std::random_device rd;
  std::mt19937 engine(rd());
  id += std::to_string(distribution(engine));
  // ...
}

```
This compliant solution also seeds the random number engine, in conformance with [MSC51-CPP. Ensure your random number generator is properly seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded).

## Risk Assessment

Using the `std::rand()` function could lead to predictable random numbers.

<table> <tbody> <tr> <th> Rule </th> <th> Severity </th> <th> Likelihood </th> <th> Remediation Cost </th> <th> Priority </th> <th> Level </th> </tr> <tr> <td> MSC50-CPP </td> <td> Medium </td> <td> Unlikely </td> <td> Low </td> <td> <strong>P6</strong> </td> <td> <strong>L2</strong> </td> </tr> </tbody> </table>


## Automated Detection

<table> <tbody> <tr> <th> Tool </th> <th> Version </th> <th> Checker </th> <th> Description </th> </tr> <tr> <td> <a> Astrée </a> </td> <td> 20.10 </td> <td> <strong>bad-function (AUTOSAR.26.5.1A)</strong> </td> <td> Fully checked </td> </tr> <tr> <td> <a> Axivion Bauhaus Suite </a> </td> <td> 7.2.0 </td> <td> <strong>CertC++-MSC50</strong> </td> <td> </td> </tr> <tr> <td> <a> Clang </a> </td> <td> 4.0 (prerelease) </td> <td> <code>cert-msc50-cpp</code> </td> <td> Checked by <code>clang-tidy</code> </td> </tr> <tr> <td> <a> CodeSonar </a> </td> <td> 7.0p0 </td> <td> <strong>BADFUNC.RANDOM.RAND</strong> </td> <td> Use of <code>rand</code> </td> </tr> <tr> <td> <a> Compass/ROSE </a> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <a> ECLAIR </a> </td> <td> 1.2 </td> <td> <strong>CC2.MSC30</strong> </td> <td> Fully implemented </td> </tr> <tr> <td> <a> Helix QAC </a> </td> <td> 2022.2 </td> <td> <strong>C++5028</strong> </td> <td> </td> </tr> <tr> <td> <a> Klocwork </a> </td> <td> 2022.2 </td> <td> <strong>CERT.MSC.STD_RAND_CALL</strong> </td> <td> </td> </tr> <tr> <td> <a> LDRA tool suite </a> </td> <td> </td> <td> <strong>44 S</strong> </td> <td> Enhanced Enforcement </td> </tr> <tr> <td> <a> Parasoft C/C++test </a> </td> <td> 2022.1 </td> <td> <strong>CERT_CPP-MSC50-a</strong> </td> <td> Do not use the rand() function for generating pseudorandom numbers </td> </tr> <tr> <td> <a> Polyspace Bug Finder </a> </td> <td> R2022a </td> <td> <a> CERT C++: MSC50-CPP </a> </td> <td> Checks for use of vulnerable pseudo-random number generator (rule partially covered) </td> </tr> <tr> <td> <a> PRQA QA-C++ </a> </td> <td> 4.4 </td> <td> <strong>5028</strong> </td> <td> Fully implemented </td> </tr> <tr> <td> <a> RuleChecker </a> </td> <td> 20.10 </td> <td> <strong>bad-function (AUTOSAR.26.5.1A)</strong> </td> <td> Fully checked </td> </tr> </tbody> </table>


## Related Vulnerabilities

Search for [vulnerabilities](https://wiki.sei.cmu.edu/confluence/display/cplusplus/BB.+Definitions) resulting from the violation of this rule on the [CERT website](https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+MSC50-CPP).

## Related Guidelines

<table> <tbody> <tr> <td> <a> SEI CERT C++ Coding Standard </a> </td> <td> <a> MSC51-CPP. Ensure your random number generator is properly seeded </a> </td> </tr> <tr> <td> <a> SEI CERT C Coding Standard </a> </td> <td> <a> MSC30-C. Do not use the rand() function for generating pseudorandom numbers </a> </td> </tr> <tr> <td> <a> CERT Oracle Secure Coding Standard for Java </a> </td> <td> <a> MSC02-J. Generate strong random numbers </a> </td> </tr> <tr> <td> <a> MITRE CWE </a> </td> <td> <a> CWE-327 </a> , Use of a Broken or Risky Cryptographic Algorithm <a> CWE-330 </a> , Use of Insufficiently Random Values </td> </tr> </tbody> </table>


## Bibliography

<table> <tbody> <tr> <td> \[ <a> ISO/IEC 9899:2011 </a> \] </td> <td> Subclause 7.22.2, "Pseudo-random Sequence Generation Functions" </td> </tr> <tr> <td> \[ <a> ISO/IEC 14882-2014 </a> \] </td> <td> Subclause 26.5, "Random Number Generation" </td> </tr> </tbody> </table>


## Implementation notes

None

## References

* CERT-C++: [MSC50-CPP: Do not use std::rand() for generating pseudorandom numbers](https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682)
