CWE-322: Key Exchange without Entity Authentication
Key Exchange without Entity Authentication
Weakness ID: 322 (Weakness Base)
Status: Draft
Description
Description Summary
The software performs a key exchange with an actor without verifying the identity of that actor.
Extended Description
Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable a set of "man-in-the-middle" attacks. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
No authentication takes place in this process, bypassing an assumed
protection of encryption.
Confidentiality
Technical Impact: Read application
data
The encrypted communication between a user and a trusted host may be
subject to a "man-in-the-middle" sniffing attack.
Likelihood of Exploit
High
Demonstrative Examples
Example 1
Many systems have used Diffie-Hellman key exchange without
authenticating the entities exchanging keys, leading to man-in-the-middle
attacks. Many people using SSL/TLS skip the authentication (often
unknowingly).
Potential Mitigations
Phase: Architecture and Design
Ensure that proper authentication is included in the system
design.
Phase: Implementation
Understand and properly implement all checks necessary to ensure the
identity of entities involved in encrypted communications.
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 23: Improper Use of PKI, Especially SSL." Page
347. McGraw-Hill. 2010.
[REF-7] Mark Dowd, John McDonald
and Justin Schuh. "The Art of Software Security Assessment". Chapter 2, "Untrustworthy Credentials", Page
37.. 1st Edition. Addison Wesley. 2006.
Description
