1. Home
  2. CWE Database
  3. CWE-1279
Base · Medium

CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

CWE-1279 · Base Level ·2 Mitigations

Description

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.

Potential Impact

Access Control, Confidentiality, Integrity, Availability, Accountability, Authentication, Authorization, Non-Repudiation

Varies by Context

Demonstrative Examples

The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.
Bad
If random_number_generator_self_test_passed() == TRUE
					  then Seed = get_random_number_from_RNG()
					  else Seed = hardcoded_number
In the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.
Good
If random_number_generator_self_test_passed() == TRUE
					  then Seed = get_random_number_from_RNG()
					  else enter_error_state()

Mitigations & Prevention

Architecture and Design

Best practices should be used to design cryptographic systems.

Implementation

Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.

CWE-696: Incorrect Behavior Order

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may pro...

CWE-665: Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected s...

Frequently Asked Questions

What is CWE-1279?

CWE-1279 (Cryptographic Operations are run Before Supporting Units are Ready) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

How can CWE-1279 be exploited?

Attackers can exploit CWE-1279 (Cryptographic Operations are run Before Supporting Units are Ready) to varies by context. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-1279?

Key mitigations include: Best practices should be used to design cryptographic systems.

What is the severity of CWE-1279?

CWE-1279 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.