Weakness (CWE)
CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
How to prevent it (2 mitigations)
-
Architecture and Design
Best practices should be used to design cryptographic systems. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.
-
Implementation
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
Source: MITRE CWE-1279
3 results · Clear filters · Feed
-
Medium 5.4
Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`
Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `secure_redundant_execution` function in feldman_vss.py attempts to mitigate fault…
-
Medium 6.8
Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
-
Medium 6.4
Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction a…