Main Content

Cryptography Defects

Defects related to incorrect use of OpenSSL cryptography routines

These defects are related to incorrect use of cryptography routines from the OpenSSL library. For instance:

  • Use of cryptographically weak algorithms

  • Absence of essential elements such as cipher key or initialization vector

  • Wrong order of cryptographic operations

Polyspace Results

expand all

Constant block cipher initialization vectorInitialization vector is constant instead of randomized
Constant cipher keyEncryption or decryption key is constant instead of randomized
Inconsistent cipher operationsYou perform encryption and decryption steps in succession with the same cipher context without a reinitialization in between
Missing block cipher initialization vectorContext used for encryption or decryption is associated with NULL initialization vector or not associated with an initialization vector
Missing cipher algorithmAn encryption or decryption algorithm is not associated with the cipher context
Missing cipher data to processFinal encryption or decryption step is performed without previous update steps
Missing cipher final stepYou do not perform a final step after update steps for encrypting or decrypting data
Missing cipher keyContext used for encryption or decryption is associated with NULL key or not associated with a key
Predictable block cipher initialization vectorInitialization vector is generated from a weak random number generator
Predictable cipher keyEncryption or decryption key is generated from a weak random number generator
Weak cipher algorithmEncryption algorithm associated with the cipher context is weak
Weak cipher modeEncryption mode associated with the cipher context is weak
Context initialized incorrectly for cryptographic operationContext used for public key cryptography operation is initialized for a different operation
Incorrect key for cryptographic algorithmPublic key cryptography operation is not supported by the algorithm used in context initialization
Missing data for encryption, decryption or signing operationData provided for public key cryptography operation is NULL or data length is zero
Missing parameters for key generationContext used for key generation is associated with NULL parameters
Missing peer keyContext used for shared secret derivation is associated with NULL peer key or not associated with a peer key at all
Missing private keyContext used for cryptography operation is associated with NULL private key or not associated with a private key at all
Missing public keyContext used for cryptography operation is associated with NULL public key or not associated with a public key at all
Nonsecure parameters for key generationContext used for key generation is associated with weak parameters
Incompatible padding for RSA algorithm operationCryptography operation is not supported by the padding type set in context
Missing blinding for RSA algorithmContext used in decryption or signature verification is not blinded against timing attacks
Missing padding for RSA algorithmContext used in encryption or signing operation is not associated with any padding
Nonsecure RSA public exponentContext used in key generation is associated with low exponent value
Weak padding for RSA algorithmContext used in encryption or signing operation is associated with insecure padding type
Context initialized incorrectly for digest operationContext used for digest operation is initialized for a different digest operation
Missing final step after hashing update operationHash is incomplete or non-secure (Since R2020a)
Missing hash algorithmContext in EVP routine is initialized without a hash algorithm
Missing salt for hashing operationHashed data is vulnerable to rainbow table attack
No data added into contextPerforming hash operation on empty context might cause run-time errors (Since R2020a)
Nonsecure hash algorithmContext used for message digest creation is associated with weak algorithm
Missing certification authority listCertificate for authentication cannot be trusted
Missing private key for X.509 certificateMissing key might result in run-time error or non-secure encryption (Since R2020a)
Missing X.509 certificateServer or client cannot be authenticated
Nonsecure SSL/TLS protocolContext used for handling SSL/TLS connections is associated with weak protocol
Server certificate common name not checkedAttacker might use valid certificate to impersonate trusted host (Since R2020a)
TLS/SSL connection method not setProgram cannot determine whether to call client or server routines (Since R2020a)
TLS/SSL connection method set incorrectlyProgram calls functions that do not match role set by connection method (Since R2020a)
X.509 peer certificate not checkedConnection might be vulnerable to man-in-the-middle attacks (Since R2020a)

Topics

  • Bug Finder Defect Groups

    The Bug Finder defect checkers are classified into groups such as data flow, concurrency, numerical, and so on.