Category:Cryptographic Vulnerability - Revision history

Frank Alexander at 16:15, 13 September 2010

2010-09-13T16:15:04Z

Weilin Zhong: /* Examples */

2006-09-15T19:45:26Z

‎Examples

Weilin Zhong at 19:15, 12 June 2006

2006-06-12T19:15:25Z

New page

This category is for tagging vulnerabilities that related to cryptographic modules.

==Examples==

* Algorithm Problems
** Insecure Algorithm
*** Use algorithms that are proven flawed or weak (DES, MD5)
*** Use non-standard (home-grown) algorithms
** Choose the wrong algorithm
*** Use hash function for encryption
*** Use encryption algorithm for hashing
** Inappropriate use of an algorithm
*** Use insecure encryption modes (DES EBC)
*** Initial vector is not random
** Implementation errors
*** Use non-standard cryptographic implementations/libraries
* Key Management Problems
** Weak keys
*** Too short or not random enough
*** Use human chosen passwords as cryptographic keys
** Key disclosure
*** Keys not encrypted during storage or transmission
*** Keys not remove after use
*** Keys Hard-coded in the code or stored in configuration files
** Key updates
*** Allow keys aging
* Random Number Generator (RNG) Problems
** Poor random number generators (c: rand(), Java: java.util.Random())
** Forget to seed the random number generator
** Use the same seed for the random number generator every time

[[Category:Vulnerability]]

{{Template:Stub}}

@@ Line 5: / Line 5: @@
 * Algorithm Problems
 ** Insecure Algorithm
-*** Use algorithms that are proven flawed or weak (DES, MD5)
+*** Use algorithms that are proven flawed or weak (DES, 3DES, MD5, Sha1, AES, Blowfish, Diffie Hellman)
 *** Use non-standard (home-grown) algorithms
 ** Choose the wrong algorithm
@@ Line 28: / Line 28: @@
 ** Poor random number generators (c: rand(), Java: java.util.Random())
 ** Forget to seed the random number generator
 ** Use the same seed for the random number generator every time
 [[Category:Vulnerability]]
 {{Template:Stub}}

@@ Line 21: / Line 21: @@
 ** Key disclosure
 *** Keys not encrypted during storage or transmission
-*** Keys not remove after use
+*** Keys not cleaned appropriately after use
 *** Keys Hard-coded in the code or stored in configuration files
 ** Key updates