Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-1279:Cryptographic Operations are run Before Supporting Units are Ready
Weakness ID:1279
Version:v4.17
Weakness Name:Cryptographic Operations are run Before Supporting Units are Ready
Vulnerability Mapping:Allowed
Abstraction:Base
Structure:Simple
Status:Incomplete
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

▼Extended Description

Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowed-with-ReviewC696Incorrect Behavior Order
ChildOfDiscouragedC665Improper Initialization
Nature: ChildOf
Mapping: Allowed-with-Review
Type: Class
ID: 696
Name: Incorrect Behavior Order
Nature: ChildOf
Mapping: Discouraged
Type: Class
ID: 665
Name: Improper Initialization
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC1205Security Primitives and Cryptography Issues
MemberOfProhibitedC1416Comprehensive Categorization: Resource Lifecycle Management
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1205
Name: Security Primitives and Cryptography Issues
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1416
Name: Comprehensive Categorization: Resource Lifecycle Management
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-244Weaknesses in Software Written in VHDL
MemberOfProhibitedBSBOSS-249Weaknesses in Software Written in Verilog
MemberOfProhibitedBSBOSS-264Weaknesses in Processor Hardware
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-298Not OS-Specific(os class) Weaknesses
MemberOfProhibitedBSBOSS-301Not Architecture-Specific (architecture class) Weaknesses
MemberOfProhibitedBSBOSS-307Not Technology-Specific (technology class) Weaknesses
MemberOfProhibitedBSBOSS-326Varies by Context (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-244
Name: Weaknesses in Software Written in VHDL
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-249
Name: Weaknesses in Software Written in Verilog
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-264
Name: Weaknesses in Processor Hardware
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-298
Name: Not OS-Specific(os class) Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-301
Name: Not Architecture-Specific (architecture class) Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-307
Name: Not Technology-Specific (technology class) Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-326
Name: Varies by Context (impact)
▼Relevant To View
Relevant to the view"Hardware Design - (1194)"
NatureMappingTypeIDName
MemberOfProhibitedC1205Security Primitives and Cryptography Issues
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1205
Name: Security Primitives and Cryptography Issues
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
Access ControlConfidentialityIntegrityAvailabilityAccountabilityAuthenticationAuthorizationNon-RepudiationN/AVaries by Context
N/A
Scope: Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation
Likelihood: N/A
Impact: Varies by Context
Note:
N/A
▼Potential Mitigations
Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Best practices should be used to design cryptographic systems.

Note:

Phase:Implementation
Mitigation ID:
Strategy:
Effectiveness:
Description:

Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.

Note:

▼Modes Of Introduction
Phase: Architecture and Design
Note:

N/A

Phase: Implementation
Note:

The decision to continue using a cryptographic unit even though the input units to it are not producing valid data will compromise the encrypted result.

▼Applicable Platforms
Languages
Class: Verilog(Undetermined Prevalence)
Class: VHDL(Undetermined Prevalence)
Class: Not Language-Specific(Undetermined Prevalence)
Technology
Class: Processor Hardware(Undetermined Prevalence)
Class: Not Technology-Specific(Undetermined Prevalence)
Operating System
Class: Not OS-Specific(Undetermined Prevalence)
Architecture
Class: Not Architecture-Specific(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.

Language: ( code)
N/A

Language: Pseudocode(Bad code)
If random_number_generator_self_test_passed() == TRUE then Seed = get_random_number_from_RNG() else Seed = hardcoded_number

Language: ( code)
N/A

In the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.

Language: Pseudocode(Good code)
If random_number_generator_self_test_passed() == TRUE then Seed = get_random_number_from_RNG() else enter_error_state()

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      ▼Related Attack Patterns
      IDName
      CAPEC-97
      Cryptanalysis
      ID: CAPEC-97
      Name: Cryptanalysis
      ▼References
      Details not found