CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.4)  

CWE-326: Weak Encryption

Individual Definition in a New Window
Weak Encryption
Status: Draft
Weakness ID: 326 (Weakness Class)
+ Description
Summary

Insufficiently strong encryption schemes may not adequately secure secret data from attackers. Attackers can guess or use brute force attacks to break weakly encrypted schemes.

+ Time of Introduction
* Architecture and Design
+ Applicable Platforms
Languages
All
+ Observed Examples
ReferenceDescription
Weak encryption
Weak encryption
Weak encryption produces same ciphertext from the same plaintext blocks.
Weak encryption
Weak encryption (XOR)
Weak encryption (reversible algorithm).
Weak encryption (one-to-one mapping).
Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness).
Weak encryption (chosen plaintext attack)
Weak encryption scheme
+ Potential Mitigations
Architecture and Design

Use a cryptographic algorithm that is currently considered to be strong by experts in the field.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory310Cryptographic Issues
Development Concepts (primary)699
ChildOfWeakness ClassWeakness ClassWeakness Class693Protection Mechanism Failure
Research Concepts (primary)1000
ChildOfCategoryCategory729OWASP Top Ten 2004 Category A8 - Insecure Storage
Weaknesses in OWASP Top Ten (2004) (primary)711
ChildOfCategoryCategory719OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
Weaknesses in OWASP Top Ten (2007) (primary)629
ChildOfCategoryCategory720OWASP Top Ten 2007 Category A9 - Insecure Communications
Weaknesses in OWASP Top Ten (2007)629
ParentOfWeakness VariantWeakness VariantWeakness Variant261Weak Cryptography for Passwords
Development Concepts699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base327Use of a Broken or Risky Cryptographic Algorithm
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base328Reversible One-Way Hash
Research Concepts (primary)1000
ParentOfWeakness ClassWeakness ClassWeakness Class759Use of a One-Way Hash without a Salt
Research Concepts (primary)1000
ParentOfWeakness ClassWeakness ClassWeakness Class760Use of a One-Way Hash with a Predictable Salt
Research Concepts (primary)1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVER  Weak Encryption
OWASP Top Ten 2007A8CWE More SpecificInsecure Cryptographic Storage
OWASP Top Ten 2007A9CWE More SpecificInsecure Communications
OWASP Top Ten 2004A8CWE More SpecificInsecure Storage
+ Maintenance Notes

A variety of encryption algorithms exist, with various weaknesses. This category could probably be split into smaller sub-categories.

+ Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Veracode. 2008-08-15. (External)
Suggested OWASP Top Ten 2004 mapping
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Maintenance_Notes, Relationships, Taxonomy_Mappings
CWE Content Team. MITRE. 2009-03-10. (Internal)
updated Relationships
CWE Content Team. MITRE. 2009-05-27. (Internal)
updated Related_Attack_Patterns
Back to top
Page Last Updated: May 26, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us