The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Extended Description
A weak encryption scheme can be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Confidentiality
Technical Impact: Bypass protection
mechanism; Read application
data
An attacker may be able to decrypt the data using brute force
attacks.
[REF-11] M. Howard and
D. LeBlanc. "Writing Secure Code". Chapter 8, "Cryptographic Foibles" Page
259. 2nd Edition. Microsoft. 2002.
[REF-17] Michael Howard, David LeBlanc
and John Viega. "24 Deadly Sins of Software Security". "Sin 21: Using the Wrong Cryptography." Page
315. McGraw-Hill. 2010.
Maintenance Notes
A variety of encryption algorithms exist, with various weaknesses. This
category could probably be split into smaller sub-categories.
Relationships between CWE-310, CWE-326, and CWE-327 and all their children need to be reviewed and reorganized.
Description
