799
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Weakness ID : 327
Structure : Simple
Abstraction : Class
Description
The product uses a broken or risky cryptographic algorithm or protocol.
Extended Description
Cryptographic algorithms are the methods by which data is scrambled to prevent observation or
influence by unauthorized actors. Insecure cryptography can be exploited to expose sensitive
information, modify data in unexpected ways, spoof identities of other users or devices, or other
impacts.
It is very difficult to produce a secure algorithm, and even high-profile algorithms by accomplished
cryptographic experts have been broken. Well-known techniques exist to break or weaken various
kinds of cryptography. Accordingly, there are a small number of well-understood and heavily
studied algorithms that should be used by most products. Using a non-standard or known-insecure
algorithm is dangerous because a determined adversary may be able to break the algorithm and
compromise whatever data has been protected.
Since the state of cryptography advances so rapidly, it is common for an algorithm to be considered
"unsafe" even if it was once thought to be strong. This can happen when new attacks are
discovered, or if computing power increases so much that the cryptographic algorithm no longer
provides the amount of protection that was originally thought.
For a number of reasons, this weakness is even more challenging to manage with hardware
deployment of cryptographic algorithms as opposed to software implementation. First, if a flaw
is discovered with hardware-implemented cryptography, the flaw cannot be fixed in most cases
without a recall of the product, because hardware is not easily replaceable like software. Second,
because the hardware product is expected to work for years, the adversary's computing power will
only increase over time.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ParentOf 328 Use of Weak Hash 806
ParentOf 780 Use of RSA Algorithm without OAEP 1644
ParentOf 1240 Use of a Cryptographic Primitive with a Risky
Implementation