CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

• Access Control, Confidentiality: Bypass Protection Mechanism, Read Application Data — An attacker may be able to decrypt the data using brute force attacks. The attacker may have a reasonable chance of succeeding using current attack methods and resources.

• [Architecture and Design] Use an encryption scheme that is currently considered to be strong by experts in the field.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2001-1546: Weak encryption • CVE-2004-2172: Weak encryption (chosen plaintext attack) • CVE-2002-1682: Weak encryption • CVE-2002-1697: Weak encryption produces same ciphertext from the same plaintext blocks. • CVE-2002-1739: Weak encryption • CVE-2005-2281: Weak encryption scheme • CVE-2002-1872: Weak encryption (XOR) • CVE-2002-1910: Weak encryption (reversible algorithm). • CVE-2002-1946: Weak encryption (one-to-one mapping). • CVE-2002-1975: Encryption error uses fixed salt, simplifying brute force / dictionary attacks (overlaps randomness).