1813
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Language : Verilog (Prevalence = Undetermined)
Language : VHDL (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
The confidentiality of sensitive data may be compromised
by the use of a broken or risky cryptographic algorithm.
Integrity Modify Application Data
The integrity of sensitive data may be compromised by the
use of a broken or risky cryptographic algorithm.
Accountability
Non-Repudiation
Hide Activities
If the cryptographic algorithm is used to ensure the identity
of the source of the data (such as digital signatures), then
a broken algorithm will compromise this scheme and the
source of the data cannot be proven.
Detection Methods
Automated Analysis
Automated methods may be useful for recognizing commonly-used libraries or features that have
become obsolete.
Effectiveness = Moderate
False negatives may occur if the tool is not aware of the cryptographic libraries in use, or if
custom cryptography is being used.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester
to record and modify an active session.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
CWE Version 4.14
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-327: Use of a Broken or Risky Cryptographic Algorithm