2121
Nature Type ID Name Page
ChildOf 665 Improper Initialization 1456
ChildOf 691 Insufficient Control Flow Management 1517
Applicable Platforms
Language : Verilog (Prevalence = Undetermined)
Language : VHDL (Prevalence = Undetermined)
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Processor Hardware (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Confidentiality
Integrity
Availability
Accountability
Authentication
Authorization
Non-Repudiation
Varies by Context
Potential Mitigations
Phase: Architecture and Design
Best practices should be used to design cryptographic systems.
Phase: Implementation
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to
ensure that the encrypted output is secure.
Demonstrative Examples
Example 1:
The following pseudocode illustrates the weak encryption resulting from the use of a pseudorandom-
number generator output.
Example Language: Pseudocode (Bad)
If random_number_generator_self_test_passed() == TRUE
then Seed = get_random_number_from_RNG()
else Seed = hardcoded_number
In the example above, first a check of RNG ready is performed. If the check fails, the RNG is
ignored and a hard coded value is used instead. The hard coded value severely weakens the
encrypted output.
Example Language: Pseudocode (Good)
If random_number_generator_self_test_passed() == TRUE
then Seed = get_random_number_from_RNG()
else enter_error_state()
MemberOf Relationships
CWE Version 4.14
CWE-1280: Access Control Check Implemented After Asset is Accessed
CWE-1280: Access Control Check Implemented After Asset is Accessed