DerScanner
Home / Vulnerability Database / C or C++ : Insufficient encryption key length
C/C++

C or C++ : Insufficient encryption key length

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP MASVS
V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored CryptographyStored CryptographyStored CryptographyAuthentication
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-326CWE-1032

Overview

Short encryption key is used. Encryption is vulnerable to brute force attacks.

Due to constant development of new attack methods and increase in hardware performance, previously considered safe algorithms become obsolete. For example, 1024 bit RSA is considered insecure starting 2010 - 2015 (in various sources) and is no longer recommended to use.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A6-Sensitive Data Exposure
  2. Cryptographic Key Length Recommendation
  3. OWASP Top 10 2017-A3-Sensitive Data Exposure
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
  5. CWE-326
CRITICAL

DerScanner Severity Score

Do you want to fix C or C++ : Insufficient encryption key length in your application?

See also

C/C++

C or C++ : Dead store

C/C++

C or C++ : Use after free

C/C++

C or C++ : va_list uninitialized