ASVS 5.0 V11.5.2 (Level 3) requires that the random number generation mechanism stays secure under heavy demand. It must not block unpredictably, fall back to a weak source, or reuse state when thousands of requests arrive at once.
Why it matters
Systems that seed a custom generator at start up, or fall back to a timestamp when the entropy source is slow, produce predictable tokens exactly when traffic is highest.
How to implement it
Use the operating system CSPRNG through your language standard library and never build your own pool.
import secrets
token = secrets.token_bytes(32)
Make sure forked workers do not share generator state, and treat a failure to obtain random bytes as a hard error rather than a reason to substitute a weaker source.
How to test it
Load test token generation with many concurrent workers, then check for duplicate outputs and for latency spikes. Confirm that an injected failure of the random source aborts the request.
Common mistakes
- Seeding a non secure generator from the clock
- Catching the error and falling back to a counter
- Sharing generator state across forked processes
Quick check
What should happen if the secure random source fails?
The operation must fail. Never fall back to a predictable source.
