2026
compliance status with the discovery of novel attacks that might either defeat the algorithm or
reduce its robustness significantly.
If ad-hoc cryptographic primitives are implemented, it is almost certain that the implementation will
be vulnerable to attacks that are well understood by cryptographers, resulting in the exposure of
sensitive information and other consequences.
This weakness is even more difficult to manage for hardware-implemented deployment of
cryptographic algorithms. First, because hardware is not patchable as easily as software, any flaw
discovered after release and production typically cannot be fixed without a recall of the product.
Secondly, the hardware product is often expected to work for years, during which time computation
power available to the attacker only increases. Therefore, for hardware implementations of
cryptographic primitives, it is absolutely essential that only strong, proven cryptographic primitives
are used.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 327 Use of a Broken or Risky Cryptographic Algorithm 799
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 310 Cryptographic Issues 2318
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Incorrect usage of crypto primitives could render the
supposedly encrypted data as unencrypted plaintext in the
worst case.
High
Detection Methods
Architecture or Design Review
Review requirements, documentation, and product design to ensure that primitives are consistent
with the strongest-available recommendations from trusted parties. If the product appears to
be using custom or proprietary implementations that have not had sufficient public review and
approval, then this is a significant concern.
Effectiveness = High
Manual Analysis
CWE Version 4.14
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation