Missing Cryptographic Step

Opis

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Skutki

• Access Control

  Bypass Protection Mechanism

• Confidentiality, Integrity

  Read Application Data; Modify Application Data

• Accountability, Non-Repudiation

  Hide Activities

Przykłady podatności

• CVE-2001-1585 Missing challenge-response step allows authentication bypass using public key.

Słabość nadrzędna

• CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
• CWE-573 Improper Following of Specification by Caller

Pokrewna

• CWE-358 Improperly Implemented Security Check for Standard

Kiedy powstaje

• Implementation — Developers sometimes omit "expensive" (resource-intensive) steps in order to improve performance, especially in devices with limited memory or slower CPUs. This step may be taken under a mistaken impression that the step is unnecessary for the cryptographic algorithm.
• Requirements — This issue may happen when the requirements for the cryptographic algorithm are not clearly stated.

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

Overlaps incomplete/missing security check.

Can be resultant.

Źródła

1. hmac_wrapper.sv — 2021
2. HMAC HWIP Technical Specification — 2023