COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1279

Cryptographic Operations are run Before Supporting Units are Ready

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Extended description

Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

The decision to continue using a cryptographic unit even though the input units to it are not producing valid data will compromise the encrypted result.

Risk

What does successful exploitation lead to?

Varies by Context

Affected security scopes: Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation

Defence

How is it prevented and fixed?

Architecture and Design

Architecture and design approach

Detail
Best practices should be used to design cryptographic systems.

Implementation

Implementation-phase defence

Detail
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.