Weakness · Medium
CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready
What it is
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
What an attacker can do
- Varies by Context (Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation)
How to prevent it
Architecture and Design
- Best practices should be used to design cryptographic systems.
Implementation
- Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.