2146
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Accountability
Authentication
Authorization
Non-Repudiation
Other
Read Memory
Modify Memory
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Varies by Context
High
Detection Methods
Architecture or Design Review
Compare the debug key with the production key to make sure that they are not the same.
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
Compare the debug key with the production key to make sure that they are not the same.
Effectiveness = High
Potential Mitigations
Phase: Implementation
Use different keys for Production and Debug
Demonstrative Examples
Example 1:
This example illustrates the danger of using the same public key for debug and production.
Example Language: Other (Bad)
Suppose the product design requires frugality of silicon real estate. Assume that originally the architecture allows just
enough storage for two 2048-bit RSA keys in the fuse: one to be used for debug and the other for production. However, in
the meantime, a business decision is taken to make the security future-proof beyond 2030, which means the architecture
needs to use the NIST-recommended 3072-bit keys instead of the originally-planned 2048-bit keys. This means that, at
most, one key can be fully stored in the fuses, not two. So the product design team decides to use the same public key for
debug and production.
Example Language: Other (Informative)
Increase the storage so that two different keys of the required size can be stored.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
CWE Version 4.14
CWE-1292: Incorrect Conversion of Security Identifiers
CWE-1292: Incorrect Conversion of Security Identifiers