2025
[REF-1055]Peter Gutmann. "Data Remanence in Semiconductor Devices". 10th USENIX Security
Symposium. 2001 August. < https://www.usenix.org/legacy/events/sec01/full_papers/gutmann/
gutmann.pdf >.
[REF-1379]"sha256_wrapper.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/b9ecdf6068445d76d6bee692d163fededf7a9d9b/piton/design/chip/tile/ariane/src/sha256/
sha256_wrapper.sv#L94-L116 >.2023-12-13.
[REF-1380]"Fix for sha256_wrapper.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/e8ba396b5c7cec9031e0e0e18ac547f32cd0ed50/piton/design/chip/tile/ariane/src/sha256/
sha256_wrapper.sv#L98C1-L139C18 >.2023-12-13.
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Weakness ID : 1240
Structure : Simple
Abstraction : Base
Description
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm
using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
Extended Description
Cryptographic protocols and systems depend on cryptographic primitives (and associated
algorithms) as their basic building blocks. Some common examples of primitives are digital
signatures, one-way hash functions, ciphers, and public key cryptography; however, the notion of
"primitive" can vary depending on point of view. See "Terminology Notes" for further explanation of
some concepts.
Cryptographic primitives are defined to accomplish one very specific task in a precisely defined and
mathematically reliable fashion. For example, suppose that for a specific cryptographic primitive
(such as an encryption routine), the consensus is that the primitive can only be broken after trying
out N different inputs (where the larger the value of N, the stronger the cryptography). For an
encryption scheme like AES-256, one would expect N to be so large as to be infeasible to execute
in a reasonable amount of time.
If a vulnerability is ever found that shows that one can break a cryptographic primitive in
significantly less than the expected number of attempts, then that primitive is considered weakened
(or sometimes in extreme cases, colloquially it is "broken"). As a result, anything using this
cryptographic primitive would now be considered insecure or risky. Thus, even breaking or
weakening a seemingly small cryptographic primitive has the potential to render the whole system
vulnerable, due to its reliance on the primitive. A historical example can be found in TLS when
using DES. One would colloquially call DES the cryptographic primitive for transport encryption in
this version of TLS. In the past, DES was considered strong, because no weaknesses were found
in it; importantly, DES has a key length of 56 bits. Trying N=2^56 keys was considered impractical
for most actors. Unfortunately, attacking a system with 56-bit keys is now practical via brute force,
which makes defeating DES encryption practical. It is now practical for an adversary to read any
information sent under this version of TLS and use this information to attack the system. As a
result, it can be claimed that this use of TLS is weak, and that any system depending on TLS with
DES could potentially render the entire system vulnerable to attack.
Cryptographic primitives and associated algorithms are only considered safe after extensive
research and review from experienced cryptographers from academia, industry, and government
entities looking for any possible flaws. Furthermore, cryptographic primitives and associated
algorithms are frequently reevaluated for safety when new mathematical and attack techniques
are discovered. As a result and over time, even well-known cryptographic primitives can lose their
CWE Version 4.14
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation