名稱: Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
一般資訊
引入方式
Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control Confidentiality | Bypass Protection Mechanism, Read Application Data 注意：An attacker may be able to decrypt the data using brute force attacks. The attacker may have a reasonable chance of succeeding using current attack methods and resources. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2001-1546 | Weak encryption |
CVE-2004-2172 | Weak encryption (chosen plaintext attack) |
CVE-2002-1682 | Weak encryption |
CVE-2002-1697 | Weak encryption produces same ciphertext from the same plaintext blocks. |
CVE-2002-1739 | Weak encryption |
CVE-2005-2281 | Weak encryption scheme |
CVE-2002-1872 | Weak encryption (XOR) |
CVE-2002-1910 | Weak encryption (reversible algorithm). |
CVE-2002-1946 | Weak encryption (one-to-one mapping). |
CVE-2002-1975 | Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness). |
潛在緩解措施
Phases : Architecture and DesignUse an encryption scheme that is currently considered to be strong by experts in the field.
偵測方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有效性 : High
漏洞對應備注
理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate備註 : Examine children of this entry to see if there is a better fit
相關攻擊模式
| CAPEC ID | 攻擊模式名稱 |
|---|---|
| CAPEC-112 | Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. |
| CAPEC-192 | Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network. |
| CAPEC-20 | Encryption Brute Forcing
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext. |
參考資料
REF-7
Writing Secure CodeMichael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Veracode | Suggested OWASP Top Ten 2004 mapping | ||
| CWE Content Team | MITRE | updated Maintenance_Notes, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | Clarified entry to focus on algorithms that do not have major weaknesses, but may not be strong enough for some purposes. | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Maintenance_Notes, Name | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Modes_of_Introduction, References, Relationships | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Maintenance_Notes, Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description, Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
