CWEweakness

CWE-1279 Cryptographic Operations are Run Before Supporting Units are Ready

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific, VHDL, Verilog
CWE version
5.0

Description

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Common consequences

• Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation: Varies by Context

Potential mitigations

• [Architecture and Design] Best practices should be used to design cryptographic systems. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied. • [Implementation] Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.

Related

Attack pattern · CAPEC (1)

Child of · CWE (2)

  • CWE-665 Improper Initialization weakness
  • CWE-696 Incorrect Behavior Order weakness

Referenced by CAPEC · weakness (1)

Referenced by CVE · weakness (3)

  • CVE-2025-29779 Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS)… vulnerability
  • CVE-2024-22473 TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. vulnerability
  • CVE-2023-4489 The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3… vulnerability