CWE-325—Missing Cryptographic Step

名称

Missing Cryptographic Step

描述

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

常见后果

范围：

Access Control

影响：

Bypass Protection Mechanism

范围：

Confidentiality, Integrity

影响：

Read Application Data, Modify Application Data

范围：

Accountability, Non-Repudiation

影响：

Hide Activities

相关 CWE

• CWE-358Improperly Implemented Security Check for Standard
• CWE-573Improper Following of Specification by Caller
• CWE-1240Use of a Cryptographic Primitive with a Risky Implementation