The software does not implement a required step in a
cryptographic algorithm, resulting in weaker encryption than advertised by that
algorithm.
Extended Description
Cryptographic implementations should follow the algorithms that define
them exactly, otherwise encryption can be weaker than expected.
Time of Introduction
Architecture and Design
Requirements
Applicable Platforms
Languages
All
Modes of Introduction
Developers sometimes omit certain "expensive" (resource-intensive) steps
in order to improve performance, especially in devices with limited memory
or CPU cycles. This could be done under a mistaken impression that the step
is unnecessary for preserving security. Alternately, the developer might
adopt a threat model that is inconsistent with that of its consumers by
accepting a risk for which the remaining protection seems "good
enough."
This issue can be introduced when the requirements for the algorithm are
not clearly stated.
Description
