CWEweakness
CWE-1279 Cryptographic Operations are Run Before Supporting Units are Ready
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific, VHDL, Verilog
- CWE version
- 5.0
Description
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Common consequences
• Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation: Varies by Context
Potential mitigations
• [Architecture and Design] Best practices should be used to design cryptographic systems. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
• [Implementation] Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
Related
Attack pattern · CAPEC (1)
- CAPEC-97 Cryptanalysis attack pattern
Child of · CWE (2)
Referenced by CAPEC · weakness (1)
- CAPEC-97 Cryptanalysis attack pattern
Referenced by CVE · weakness (3)
- CVE-2025-29779 Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS)… vulnerability
- CVE-2024-22473 TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. vulnerability
- CVE-2023-4489 The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3… vulnerability