Inadequate Encryption Strength

Opis

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.

Skutki

• Access Control, Confidentiality

  Bypass Protection Mechanism; Read Application Data

  An attacker may be able to decrypt the data using brute force attacks.

Zapobieganie

• Architecture and Design

  Use an encryption scheme that is currently considered to be strong by experts in the field.

Przykłady podatności

• CVE-2001-1546 Weak encryption
• CVE-2004-2172 Weak encryption (chosen plaintext attack)
• CVE-2002-1682 Weak encryption
• CVE-2002-1697 Weak encryption produces same ciphertext from the same plaintext blocks.
• CVE-2002-1739 Weak encryption
• CVE-2005-2281 Weak encryption scheme
• CVE-2002-1872 Weak encryption (XOR)
• CVE-2002-1910 Weak encryption (reversible algorithm).
• CVE-2002-1946 Weak encryption (one-to-one mapping).
• CVE-2002-1975 Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness).

Słabość nadrzędna

• CWE-693 Protection Mechanism Failure

Słabości podrzędne

• CWE-328 Use of Weak Hash

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 8, "Cryptographic Foibles" Page 259, Microsoft Press, 2002
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 21: Using the Wrong Cryptography." Page 315, McGraw-Hill, 2010