803
Example 2:
Suppose a chip manufacturer decides to implement a hashing scheme for verifying integrity
property of certain bitstream, and it chooses to implement a SHA1 hardware accelerator for to
implement the scheme.
Example Language: Other (Bad)
The manufacturer chooses a SHA1 hardware accelerator for to implement the scheme because it already has a working
SHA1 Intellectual Property (IP) that the manufacturer had created and used earlier, so this reuse of IP saves design cost.
However, SHA1 was theoretically broken in 2005 and practically broken in 2017 at a cost of $110K.
This means an attacker with access to cloud-rented computing power will now be able to provide
a malicious bitstream with the same hash value, thereby defeating the purpose for which the hash
was used.
This issue could have been avoided with better design.
Example Language: Other (Good)
The manufacturer could have chosen a cryptographic solution that is recommended by the wide security community
(including standard-setting bodies like NIST) and is not expected to be broken (or even better, weakened) within the
reasonable life expectancy of the hardware product. In this case, the architects could have used SHA-2 or SHA-3, even if it
meant that such choice would cost extra.
Example 3:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple OT products used weak cryptography.
Observed Examples
Reference Description
CVE-2022-30273 SCADA-based protocol supports a legacy encryption mode that uses Tiny
Encryption Algorithm (TEA) in ECB mode, which leaks patterns in messages
and cannot protect integrity
https://www.cve.org/CVERecord?id=CVE-2022-30273
CVE-2022-30320 Programmable Logic Controller (PLC) uses a protocol with a cryptographically
insecure hashing algorithm for passwords.
https://www.cve.org/CVERecord?id=CVE-2022-30320
CVE-2008-3775 Product uses "ROT-25" to obfuscate the password in the registry.
https://www.cve.org/CVERecord?id=CVE-2008-3775
CVE-2007-4150 product only uses "XOR" to obfuscate sensitive data
https://www.cve.org/CVERecord?id=CVE-2007-4150
CVE-2007-5460 product only uses "XOR" and a fixed key to obfuscate sensitive data
https://www.cve.org/CVERecord?id=CVE-2007-5460
CVE-2005-4860 Product substitutes characters with other characters in a fixed way, and also
leaves certain input characters unchanged.
https://www.cve.org/CVERecord?id=CVE-2005-4860
CVE-2002-2058 Attackers can infer private IP addresses by dividing each octet by the MD5
hash of '20'.
https://www.cve.org/CVERecord?id=CVE-2002-2058
CVE-2008-3188 Product uses DES when MD5 has been specified in the configuration, resulting
in weaker-than-expected password hashes.
CWE Version 4.14
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-327: Use of a Broken or Risky Cryptographic Algorithm