Add MASTG-TEST-0063: Testing Random Number Generation (iOS) #3521

Copilot · 2025-11-15T20:17:55Z

This PR closes #3349

Description

Adds MASTG v2 test and demo for detecting insecure random number generation in iOS apps.

Changes

Test: tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0063.md
- Static analysis test for insecure random APIs (rand, random, srand, srandom)
- Maps to MASWE-0027 (Insecure Random API Usage)
- Focuses on security-relevant contexts: keys, tokens, nonces, IVs
Demo: demos/ios/MASVS-CRYPTO/MASTG-DEMO-0063/
- Swift sample contrasting insecure (rand()/srand()) vs secure (SecRandomCopyBytes)
- radare2 script detecting insecure random function calls
- Expected disassembly output showing symbol references

// Insecure: predictable, deterministic
srand(UInt32(time(nil)))
let token = rand() % 256

// Secure: cryptographically secure from entropy pool
SecRandomCopyBytes(kSecRandomDefault, count, &randomBytes)

Dynamic analysis omitted per issue requirements.

[x] I have read the contributing guidelines.

Original prompt

This section details on the original issue you should resolve

<issue_title>MASTG v1->v2 MASTG-TEST-0063: Testing Random Number Generation (ios)</issue_title>
<issue_description>
Create a new MASTG v2 test covering for":

Title: Testing Random Number Generation

ID: MASTG-TEST-0063

Link: https://mas.owasp.org/MASTG/tests/ios/MASVS-CRYPTO/MASTG-TEST-0063/

Platform: ios

MASVS v1: ['MSTG-CRYPTO-6']

MASVS v2: ['MASVS-CRYPTO-1']

Follow the guidelines
</issue_description>

<agent_instructions>Create a static test in tests-beta similar to others and also one demo. Ignore the dynamic analysis part of the original test.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Fixes MASTG v1->v2 MASTG-TEST-0063: Testing Random Number Generation (ios) #2944

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…ion testing Co-authored-by: cpholguera <[email protected]>

…SPRNG, SecRandomCopyBytes, and Swift's random APIs

knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0070.md

… scripts, and improve output handling

Copilot

Pull Request Overview

This PR adds comprehensive MASTG v2 test coverage for detecting insecure random number generation on iOS, addressing issue #3349.

Key Changes:

New static analysis test (MASTG-TEST-xx63) for detecting insecure random APIs (rand, srand, drand48)
Comprehensive knowledge article (MASTG-KNOW-0070) explaining iOS random number generation APIs
Two demos: radare2-based static detection (MASTG-DEMO-0063) and frida-trace runtime monitoring (MASTG-DEMO-0064)
Best practices guide (MASTG-BEST-00x1) recommending secure random APIs
Deprecation of old v1 test with reference to new version

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
tests/ios/MASVS-CRYPTO/MASTG-TEST-0063.md	Marks v1 test as deprecated and references new v2 test
tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-xx63.md	New v2 static test for insecure random API detection, maps to MASWE-0027
knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0070.md	Comprehensive documentation of iOS random number generation including secure/insecure APIs with code examples
demos/ios/MASVS-CRYPTO/MASTG-DEMO-0063/	Static analysis demo using radare2 to detect insecure random function calls with Swift sample code
demos/ios/MASVS-CRYPTO/MASTG-DEMO-0064/	Dynamic analysis demo using frida-trace to monitor random API usage at runtime
best-practices/MASTG-BEST-00x1.md	Best practices guide for using secure random number generators on iOS

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0064/MASTG-DEMO-0064.md

Copilot · 2025-11-20T09:06:05Z

best-practices/MASTG-BEST-00x1.md

+- In Flutter or Dart use [`Random.secure()`](https://api.flutter.dev/flutter/dart-math/Random/Random.secure.html), which is documented as cryptographically secure. It reaches `SecRandomCopyBytes` through [the platform integration layers](https://github.com/dart-lang/sdk/blob/47e77939fce74ffda0b7252f33ba1ced2ea09c52/runtime/bin/crypto_macos.cc#L16). See [this article](https://www.zellic.io/blog/proton-dart-flutter-csprng-prng/) for a security review.
+- In React Native use a library such as [`react-native-secure-random`](https://github.com/robhogan/react-native-securerandom) or [`react-native-get-random-values`](https://github.com/LinusU/react-native-get-random-values), which internally calls `SecRandomCopyBytes` on iOS.


Missing punctuation in list items: According to the guidelines, list items that are complete sentences should end with periods. These list items are complete sentences and should have periods at the end.

Copilot · 2025-11-20T09:06:05Z

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0064/MASTG-DEMO-0064.md

+- `rand` and `srand`, which expose the insecure libc PRNG.
+- `drand48`, which also uses an insecure linear congruential generator.


Missing punctuation in list items: According to the guidelines, list items that are complete sentences should end with periods. These list items are complete sentences and should have periods at the end.

tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-xx63.md

Copilot · 2025-11-20T09:06:05Z

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0063/MASTG-DEMO-0063.md

+
+### Sample
+
+The following sample demonstrates various methods of generating random tokens, and contrasts insecure and secure approaches. It includes


Incomplete sentence: The paragraph ends with "It includes" but doesn't complete the thought before starting the list. Either complete the introductory sentence (e.g., "It includes:") or rephrase to make it a complete sentence. Per the guidelines, introductory sentences before lists should be complete.

Copilot · 2025-11-20T09:06:07Z

tests/ios/MASVS-CRYPTO/MASTG-TEST-0063.md

 profiles: [L1, L2]
+status: deprecated
+covered_by: [MASTG-TEST-xx63]
+deprecation_note: New version available in MASTG V2


Inconsistent capitalization: "MASTG V2" should be "MASTG v2" (lowercase 'v') to maintain consistency with how version numbers are typically written.

Suggested change

deprecation_note: New version available in MASTG V2

deprecation_note: New version available in MASTG v2

Copilot · 2025-11-20T09:06:07Z

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0063/MASTG-DEMO-0063.md

+- Insecure methods using libc `rand`, `srand`, and `drand48`
+- Other secure methods such as direct reads from `/dev/random`, `arc4random`, `arc4random_uniform`, `SystemRandomNumberGenerator`, and `CCRandomGenerateBytes`
+- A preferred secure method using `SecRandomCopyBytes`


Missing punctuation in list items: According to the guidelines, list items that complete the introductory sentence should have punctuation. These list items should end with commas (except the last) or be reformatted as complete sentences with periods.

Copilot · 2025-11-20T09:06:07Z

best-practices/MASTG-BEST-00x1.md

+- **Security Framework (preferred)**: Use the [`SecRandomCopyBytes`](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)) API from the Security framework, which produces cryptographically secure random bytes backed by the system CSPRNG.
+- **CommonCrypto**: You _could_ use `CCRandomCopyBytes` or `CCRandomGenerateBytes` (not documented on the Apple Developers website), which are also backed by the system CSPRNG. However, prefer `SecRandomCopyBytes` which is a wrapper around these functions.
+- **Swift Standard Library**: You can use the Swift Standard Library `.random` APIs which are backed by `SystemRandomNumberGenerator`. However, note that their random number generator can be customized, so ensure you use the default `SystemRandomNumberGenerator` (e.g., by not specifying a custom generator) or a secure alternative (ensure it is cryptographically secure).
+- ***CryptoKit**: CryptoKit doesn't expose a direct random byte generator, but it provides secure random nonces and keys through its cryptographic operations, which are backed by the system CSPRNG. For example, you can use `SymmetricKey` for keys and `AES.GCM.Nonce` for nonces without needing to manage raw random bytes directly.


Missing punctuation in list items: According to the guidelines, list items that are complete sentences should end with periods. These list items appear to be complete sentences and should have periods at the end.

best-practices/MASTG-BEST-00x1.md

knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0070.md

Co-authored-by: Copilot <[email protected]>

…tation and streamline output descriptions

…ithub.com/OWASP/owasp-mastg into copilot/add-random-number-generation-test

github-actions · 2025-11-20T13:44:17Z

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0063/MASTG-DEMO-0063.md

@@ -0,0 +1,72 @@
+---


⚠️ Duplicate MASTG-DEMO ID Detected

This file has the ID MASTG-DEMO-0063 which already exists in demos/android/MASVS-PLATFORM/MASTG-DEMO-0063/MASTG-DEMO-0063.md.

IMPORTANT: Please use the next available ID: MASTG-DEMO-0068

github-actions · 2025-11-20T13:44:18Z

demos/ios/MASVS-CRYPTO/MASTG-DEMO-0064/MASTG-DEMO-0064.md

@@ -0,0 +1,38 @@
+---


⚠️ Duplicate MASTG-DEMO ID Detected

This file has the ID MASTG-DEMO-0064 which already exists in demos/android/MASVS-STORAGE/MASTG-DEMO-0064/MASTG-DEMO-0064.md.

IMPORTANT: Please use the next available ID: MASTG-DEMO-0069

Copilot AI self-assigned this Nov 15, 2025

Initial plan

affd190

Copilot AI assigned cpholguera Nov 15, 2025

Copilot started work on behalf of cpholguera November 15, 2025 20:18 View session

Add MASTG-TEST-0063 and MASTG-DEMO-0063 for iOS random number generat…

bf62947

…ion testing Co-authored-by: cpholguera <[email protected]>

Copilot AI changed the title ~~[WIP] Add testing for random number generation in MASTG v2~~ Add MASTG-TEST-0063: Testing Random Number Generation (iOS) Nov 15, 2025

Copilot finished work on behalf of cpholguera November 15, 2025 20:28

Copilot AI requested a review from cpholguera November 15, 2025 20:28

cpholguera added 11 commits November 16, 2025 19:34

Enhance documentation on random number generation in iOS, detailing C…

90b3d51

…SPRNG, SecRandomCopyBytes, and Swift's random APIs

add corrections

5ce23ca

deprecate old test

c915927

rename new test

e916091

add best

afa155e

add corrections

7c2007c

add corrections

b673c00

add corrections

5f85eb8

add corrections

bf421bc

add corrections

18c0ffa

Merge branch 'master' into copilot/add-random-number-generation-test

310fa11

cpholguera reviewed Nov 16, 2025

View reviewed changes

knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0070.md Outdated Show resolved Hide resolved

cpholguera added 6 commits November 16, 2025 20:52

Update knowledge/ios/MASVS-CRYPTO/MASTG-KNOW-0070.md

779fff5

Refactor random number generation BEST for clarity and completeness

de528d6

Clarify context verification for insecure random API usage in test case

ec1d38e

Enhance random number generation demo: update samples, add evaluation…

7d65361

… scripts, and improve output handling

Add demo for insecure random number generation with frida-trace

9a20ebf

Merge branch 'master' into copilot/add-random-number-generation-test

131a517

cpholguera requested a review from Copilot November 20, 2025 09:01

Copilot started reviewing on behalf of cpholguera November 20, 2025 09:01 View session

Copilot finished reviewing on behalf of cpholguera November 20, 2025 09:05

Copilot AI reviewed Nov 20, 2025

View reviewed changes

cpholguera and others added 3 commits November 20, 2025 13:31

Apply suggestions from code review

52023b2

Co-authored-by: Copilot <[email protected]>

Refactor random token generation examples: remove custom LCG implemen…

25c4d84

…tation and streamline output descriptions

Merge branch 'copilot/add-random-number-generation-test' of https://g…

5ca0919

…ithub.com/OWASP/owasp-mastg into copilot/add-random-number-generation-test

github-actions bot reviewed Nov 20, 2025

View reviewed changes

cpholguera requested a review from serek8 November 20, 2025 16:49

cpholguera marked this pull request as ready for review November 20, 2025 16:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add MASTG-TEST-0063: Testing Random Number Generation (iOS) #3521

Add MASTG-TEST-0063: Testing Random Number Generation (iOS) #3521

Copilot AI commented Nov 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Copilot AI Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot Nov 20, 2025

Uh oh!

github-actions bot Nov 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		- In Flutter or Dart use [`Random.secure()`](https://api.flutter.dev/flutter/dart-math/Random/Random.secure.html), which is documented as cryptographically secure. It reaches `SecRandomCopyBytes` through [the platform integration layers](https://github.com/dart-lang/sdk/blob/47e77939fce74ffda0b7252f33ba1ced2ea09c52/runtime/bin/crypto_macos.cc#L16). See [this article](https://www.zellic.io/blog/proton-dart-flutter-csprng-prng/) for a security review.
		- In React Native use a library such as [`react-native-secure-random`](https://github.com/robhogan/react-native-securerandom) or [`react-native-get-random-values`](https://github.com/LinusU/react-native-get-random-values), which internally calls `SecRandomCopyBytes` on iOS.

		- `rand` and `srand`, which expose the insecure libc PRNG.
		- `drand48`, which also uses an insecure linear congruential generator.


		### Sample

		The following sample demonstrates various methods of generating random tokens, and contrasts insecure and secure approaches. It includes

	deprecation_note: New version available in MASTG V2
	deprecation_note: New version available in MASTG v2

Uh oh!

Add MASTG-TEST-0063: Testing Random Number Generation (iOS) #3521

Are you sure you want to change the base?

Add MASTG-TEST-0063: Testing Random Number Generation (iOS) #3521

Conversation

Copilot AI commented Nov 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Comments on the Issue (you are @copilot in this section)

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot Nov 20, 2025

Choose a reason for hiding this comment

⚠️ Duplicate MASTG-DEMO ID Detected

Uh oh!

github-actions bot Nov 20, 2025

Choose a reason for hiding this comment

⚠️ Duplicate MASTG-DEMO ID Detected

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Nov 15, 2025 •

edited

Loading

⚠️ Duplicate `MASTG-DEMO` ID Detected

⚠️ Duplicate `MASTG-DEMO` ID Detected