1644
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 4-1 Req SD-1
ISA/IEC 62443 Part 4-1 Req SVV-3
ISA/IEC 62443 Part 4-2 Req CR 7.2
CWE-780: Use of RSA Algorithm without OAEP
Weakness ID : 780
Structure : Simple
Abstraction : Variant
Description
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption
Padding (OAEP), which might weaken the encryption.
Extended Description
Padding schemes are often used with cryptographic algorithms to make the plaintext less
predictable and complicate attack efforts. The OAEP scheme is often used with RSA to nullify the
impact of predictable common text.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 327 Use of a Broken or Risky Cryptographic Algorithm 799
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Without OAEP in RSA encryption, it will take less work for
an attacker to decrypt the data or to infer patterns from the
ciphertext.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
CWE Version 4.14
CWE-780: Use of RSA Algorithm without OAEP
CWE-780: Use of RSA Algorithm without OAEP