Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
View on MITREMany cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
Best practices should be used to design cryptographic systems.
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
No detection method information available for this CWE.
The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.
In the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.
The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.
In the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.
No relationship information available for this CWE.
CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result. Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
If exploited, CWE-1279 (Cryptographic Operations are run Before Supporting Units are Ready) it can compromise Access Control, Confidentiality, Integrity, Availability, Accountability and Authentication, leading to outcomes such as Varies by Context.
Recommended mitigations for CWE-1279 include: Best practices should be used to design cryptographic systems. Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
CWE-1279 commonly affects Verilog, VHDL and Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-1279 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.