CWE - CWE-310: Cryptographic Issues (3.2)

Category ID: 310

Status: Draft

Summary

Weaknesses in this category are related to the use of cryptography.

Membership

Nature	Type	ID	Name
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	254	7PK - Security Features
MemberOf	Category - a CWE entry that contains a set of other entries that share a common characteristic.	254	7PK - Security Features
MemberOf	View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).	635	Weaknesses Originally Used by NVD from 2008 to 2016
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	295	Improper Certificate Validation
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	311	Missing Encryption of Sensitive Data
HasMember	Category - a CWE entry that contains a set of other entries that share a common characteristic.	320	Key Management Errors
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	325	Missing Required Cryptographic Step
HasMember	Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness.	326	Inadequate Encryption Strength
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	327	Use of a Broken or Risky Cryptographic Algorithm
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	328	Reversible One-Way Hash
HasMember	Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness.	329	Not Using a Random IV with CBC Mode
HasMember	Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness.	347	Improper Verification of Cryptographic Signature
HasMember	Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness.	780	Use of RSA Algorithm without OAEP

Notes

Maintenance

This category is incomplete and needs refinement, as there is good documentation of cryptographic flaws and related attacks.

Maintenance

Relationships between CWE-310, CWE-326, and CWE-327 and all their children need to be reviewed and reorganized.

References

[REF-7] Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 8, "Cryptographic Foibles" Page 259. 2nd Edition. Microsoft Press. 2002-12-04. <https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223>.

Content History

Submissions
Submission Date	Submitter	Organization
	PLOVER

Modifications
Modification Date	Modifier	Organization
2008-09-08	CWE Content Team	MITRE
2008-09-08	updated Maintenance_Notes, Relationships, Relationship_Notes, Taxonomy_Mappings
2009-07-27	CWE Content Team	MITRE
2009-07-27	updated Maintenance_Notes, Relationship_Notes, Relationships
2009-10-29	CWE Content Team	MITRE
2009-10-29	updated Relationships
2010-02-16	CWE Content Team	MITRE
2010-02-16	updated References
2013-07-17	CWE Content Team	MITRE
2013-07-17	updated Relationships
2014-02-18	CWE Content Team	MITRE
2014-02-18	updated Related_Attack_Patterns
2015-12-07	CWE Content Team	MITRE
2015-12-07	updated Relationships
2017-01-19	CWE Content Team	MITRE
2017-01-19	updated Relationships
2017-11-08	CWE Content Team	MITRE
2017-11-08	updated Applicable_Platforms, Functional_Areas, References, Related_Attack_Patterns, Relationship_Notes
2018-03-27	CWE Content Team	MITRE
2018-03-27	updated References, Relationships

Common Weakness Enumeration

CWE CATEGORY: Cryptographic Issues


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email cwe@mitre.org. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2019, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy Policy Terms of Use Site Map Contact Us