CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready
Description
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Submission Date :
Feb. 12, 2020, midnight
Modification Date :
2023-10-26 00:00:00+00:00
Organization :
Intel Corporation
Extended Description
Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
Example - 1
The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.
If random_number_generator_self_test_passed() == TRUEthen Seed = get_random_number_from_RNG()else Seed = hardcoded_numberIn the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.
If random_number_generator_self_test_passed() == TRUEthen Seed = get_random_number_from_RNG()else enter_error_state()Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.