790
Understand and properly implement all checks necessary to ensure the identity of entities
involved in encrypted communications.
Demonstrative Examples
Example 1:
Many systems have used Diffie-Hellman key exchange without authenticating the entities
exchanging keys, allowing attackers to influence communications by redirecting or interfering with
the communication path. Many people using SSL/TLS skip the authentication (often unknowingly).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 959 SFP Secondary Cluster: Weak Cryptography 888 2398
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Key exchange without entity
authentication
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-323: Reusing a Nonce, Key Pair in Encryption
Weakness ID : 323
Structure : Simple
Abstraction : Base
Description
Nonces should be used for the present occasion and only once.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 344 Use of Invariant Value in Dynamically Changing Context 849
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-323: Reusing a Nonce, Key Pair in Encryption
CWE-323: Reusing a Nonce, Key Pair in Encryption