2030
Nature Type ID Name Page
MemberOf 1205 Security Primitives and Cryptography Issues 1194 2473
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Terminology
Terminology for cryptography varies widely, from informal and colloquial to mathematicallydefined,
with different precision and formalism depending on whether the stakeholder is a
developer, cryptologist, etc. Yet there is a need for CWE to be self-consistent while remaining
understandable and acceptable to multiple audiences. As of CWE 4.6, CWE terminology
around "primitives" and "algorithms" is emerging as shown by the following example, subject
to future consultation and agreement within the CWE and cryptography communities. Suppose
one wishes to send encrypted data using a CLI tool such as OpenSSL. One might choose
to use AES with a 256-bit key and require tamper protection (GCM mode, for instance). For
compatibility's sake, one might also choose the ciphertext to be formatted to the PKCS#5
standard. In this case, the "cryptographic system" would be AES-256-GCM with PKCS#5
formatting. The "cryptographic function" would be AES-256 in the GCM mode of operation, and
the "algorithm" would be AES. Colloquially, one would say that AES (and sometimes AES-256)
is the "cryptographic primitive," because it is the algorithm that realizes the concept of symmetric
encryption (without modes of operation or other protocol related modifications). In practice,
developers and architects typically refer to base cryptographic algorithms (AES, SHA, etc.) as
cryptographic primitives.
Maintenance
Since CWE 4.4, various cryptography-related entries, including CWE-327 and CWE-1240, have
been slated for extensive research, analysis, and community consultation to define consistent
terminology, improve relationships, and reduce overlap or duplication. As of CWE 4.6, this work
is still ongoing.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
97 Cryptanalysis
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-1227]Wikipedia. "Cryptographic primitive". < https://en.wikipedia.org/wiki/
Cryptographic_primitive >.
[REF-1226]Information Technology Laboratory, National Institute of Standards and Technology.
"FIPS PUB 140-2: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May
5. < https://csrc.nist.gov/publications/detail/fips/140/2/final >.
[REF-1192]Information Technology Laboratory, National Institute of Standards and Technology.
"FIPS PUB 140-3: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2019
March 2. < https://csrc.nist.gov/publications/detail/fips/140/3/final >.
[REF-1236]NIST. "CAVP Testing: Individual Component Testing". < https://csrc.nist.gov/projects/
cryptographic-algorithm-validation-program/component-testing >.
CWE-1241: Use of Predictable Algorithm in Random Number Generator
CWE Version 4.14
CWE-1241: Use of Predictable Algorithm in Random Number Generator
CWE-1241: Use of Predictable Algorithm in Random Number Generator