CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Description
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Confidentiality
Read Application Data
Incorrect usage of crypto primitives could render the supposedly encrypted data as unencrypted plaintext in the worst case.
Potential mitigations
- RequirementsEffectiveness: High
Require compliance with the strongest-available recommendations from trusted parties, and require that compliance must be kept up-to-date, since recommendations evolve over time. For example, US government systems require FIPS 140-3 certification, which supersedes FIPS 140-2.
- Architecture and DesignEffectiveness: High
Ensure that the architecture/design uses the strongest-available primitives and algorithms from trusted parties. For example, US government systems require FIPS 140-3 certification, which supersedes FIPS 140-2.
- Architecture and DesignEffectiveness: Discouraged Common Practice
Do not develop custom or private cryptographic algorithms. They will likely be exposed to attacks that are well-understood by cryptographers. As with all cryptographic mechanisms, the source code should be available for analysis. If the algorithm may be compromised when attackers find out how it works, then it is especially weak.
- Architecture and DesignEffectiveness: Discouraged Common Practice
Try not to use cryptographic algorithms in novel ways or with new modes of operation even when you know it is secure. For example, using SHA-2 chaining to create a 1-time pad for encryption might sound like a good idea, but one should not do this.
- Architecture and DesignEffectiveness: Defense in Depth
Ensure that the design can replace one cryptographic primitive or algorithm with another in the next generation (cryptographic agility). Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms. This is especially important for hardware, which can be more difficult to upgrade quickly than software; design the hardware at a replaceable block level.
- Architecture and DesignEffectiveness: Discouraged Common Practice
Do not use outdated or non-compliant cryptography algorithms. Some older algorithms, once thought to require a billion years of computing time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong.
- Architecture and DesignImplementationEffectiveness: Discouraged Common Practice
Do not use a linear-feedback shift register (LFSR) or other legacy methods as a substitute for an accepted and standard Random Number Generator.
- Architecture and DesignImplementationEffectiveness: Discouraged Common Practice
Do not use a checksum as a substitute for a cryptographically generated hash.
MITRE lists 3 more mitigations on the official entry.