OWASPASVS 5.0 requirement
ASVS-V11.5.1 All random numbers and strings which are intended to be non-guessable must be generated using a cryptographically secure pseudo-random…
- Standard
- OWASP ASVS 5.0
- Chapter
- V11 Cryptography
- Section
- V11.5 Random Values
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that all random numbers and strings which are intended to be non-guessable must be generated using a cryptographically secure pseudo-random number generator (CSPRNG) and have at least 128 bits of entropy. Note that UUIDs do not respect this condition.