From d499f30cb3d6ddce15c329985470b8ee55904f39 Mon Sep 17 00:00:00 2001 From: Josh Grossman Date: Thu, 5 Dec 2024 19:18:17 +0200 Subject: [PATCH] Add entropy requirement to resolve #2411 --- 5.0/en/0x14-V6-Cryptography.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/5.0/en/0x14-V6-Cryptography.md b/5.0/en/0x14-V6-Cryptography.md index 7bda8ebb6b..76befbccec 100644 --- a/5.0/en/0x14-V6-Cryptography.md +++ b/5.0/en/0x14-V6-Cryptography.md @@ -62,7 +62,7 @@ Cryptographically secure Pseudo-random Number Generation (CSPRNG) is incredibly | # | Description | L1 | L2 | L3 | CWE | | :---: | :--- | :---: | :---: | :---: | :---: | -| **6.3.1** | [GRAMMAR, LEVEL L2 > L1] Verify that all random numbers and strings which are intended to be non-guessable must be generated using a cryptographically-secure pseudo-random number generator (CSPRNG). | ✓ | ✓ | ✓ | 338 | +| **6.3.1** | [GRAMMAR, LEVEL L2 > L1] Verify that all random numbers and strings which are intended to be non-guessable must be generated using a cryptographically-secure pseudo-random number generator (CSPRNG) and have at least 128 bits of entropy. | ✓ | ✓ | ✓ | 338 | | **6.3.2** | [MODIFIED] Verify that UUIDs are created with an implementation of the UUID v4 or v7 algorithms which utilizes a cryptographically-secure pseudo-random number generator (CSPRNG). | | ✓ | ✓ | 338 | | **6.3.3** | [GRAMMAR, LEVEL L3 > L1] Verify that random number generation works properly under heavy system load, or that the system degrades gracefully. | ✓ | ✓ | ✓ | 338 |