Add entropy requirement to resolve #2411

OWASP · Dec 5, 2024 · d499f30 · d499f30
1 parent 66da30f
commit d499f30
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/5.0/en/0x14-V6-Cryptography.md b/5.0/en/0x14-V6-Cryptography.md
@@ -62,7 +62,7 @@ Cryptographically secure Pseudo-random Number Generation (CSPRNG) is incredibly
 
 | # | Description | L1 | L2 | L3 | CWE |
 | :---: | :--- | :---: | :---: | :---: | :---: |
-| **6.3.1** | [GRAMMAR, LEVEL L2 > L1] Verify that all random numbers and strings which are intended to be non-guessable must be generated using a cryptographically-secure pseudo-random number generator (CSPRNG). | ✓ | ✓ | ✓ | 338 |
+| **6.3.1** | [GRAMMAR, LEVEL L2 > L1] Verify that all random numbers and strings which are intended to be non-guessable must be generated using a cryptographically-secure pseudo-random number generator (CSPRNG) and have at least 128 bits of entropy. | ✓ | ✓ | ✓ | 338 |
 | **6.3.2** | [MODIFIED] Verify that UUIDs are created with an implementation of the UUID v4 or v7 algorithms which utilizes a cryptographically-secure pseudo-random number generator (CSPRNG). | | ✓ | ✓ | 338 |
 | **6.3.3** | [GRAMMAR, LEVEL L3 > L1] Verify that random number generation works properly under heavy system load, or that the system degrades gracefully. | ✓ | ✓ | ✓ | 338 |