이름: Cryptographic Operations are Run Before Supporting Units are Ready

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

일반 정보

배경 세부 정보

취약점 도입 방식

Architecture and Design
Implementation : The decision to continue using a cryptographic unit even though the input units to it are not producing valid data will compromise the encrypted result.

적용 가능한 플랫폼

언어

이름: Verilog (Undetermined)
이름: VHDL (Undetermined)
클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: Not OS-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

이름: Processor Hardware (Undetermined)
클래스: Not Technology-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control Confidentiality Integrity Availability Accountability Authentication Authorization Non-Repudiation	Varies by Context

잠재적 완화 방법

Phases : Architecture and Design
Best practices should be used to design cryptographic systems. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
Phases : Implementation
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

관련 공격 패턴

CAPEC ID	공격 패턴 이름
CAPEC-97	Cryptanalysis Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful. An attacker may have other goals as well, such as: Total Break (finding the secret key), Global Deduction (finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key), Information Deduction (gaining some information about plaintexts or ciphertexts that was not previously known) and Distinguishing Algorithm (the attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits).

제출

이름	조직	날짜	출시일	Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi	Intel Corporation	2020-02-12 +00:00	2020-02-24 +00:00	4.1

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2020-08-20 +00:00	updated Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Modes_of_Introduction, Name, Potential_Mitigations, Related_Attack_Patterns
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2022-04-28 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2022-06-28 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2022-10-13 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Relationships
CWE Content Team	MITRE	2025-04-03 +00:00	updated Relationships
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Background_Details, Description, Potential_Mitigations

CWE-1279 상세 정보

CWE-1279