Inadequate Encryption Strength (CWE-326)

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Using encryption with insufficient key lengths or deprecated algorithms provides a false sense of security. Attackers with sufficient resources can break weak encryption.

Verbreitung

Mittel

1 Sprachen abgedeckt

Auswirkung

Hoch

2 Regeln mit hohem Schweregrad

Prävention

Dokumentiert

2 Fix-Beispiele

2 Prävention

So behebst du diese Schwachstelle

🐍 Python Alle anzeigen Python Details →

JWT Signed with Weak Secret HIGH

Use strong secrets from environment variables for JWT signing, never hardcode

+6 -3 python

  import jwt
- 
- def create_token(user_id):
-     return jwt.encode({'user_id': user_id}, 'secret', algorithm='HS256')
+ import os
+ 
+ SECRET_KEY = os.environ['JWT_SECRET_KEY']
+ 
+ def create_token(user_id):
+     return jwt.encode({'user_id': user_id}, SECRET_KEY, algorithm='HS256')

Weak Cryptographic Key Generation HIGH

Use RSA 2048+ bits or AES-256 with cryptographically secure key generation

+1 -1 python

  from Crypto.PublicKey import RSA
  
- key = RSA.generate(1024)
+ key = RSA.generate(2048)

3 Erkennung

Finden Sie Schwachstellen in Ihrem Code

Verwenden Sie Shoulder, um Ihren Code nach Inadequate Encryption Strength-Mustern zu scannen. 2 Regeln.

Terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=326

# Or scan entire project
npx @shoulderdev/cli trust .

Erkennungsregeln (2)

🐍 Python 2 rules

JWT Signed with Weak Secret HIGH

Detects JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced.

Weak Cryptographic Key Generation HIGH

Detects weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithms. Cryptographic keys must be sufficiently long and generated with secure random sources.

4 Warnzeichen

Worauf bei Code-Reviews zu achten ist

Diese Muster weisen auf potenzielle Inadequate Encryption Strength-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.

🟠

JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced python-jwt-weak-secret

🟠

weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithm python-weak-key-generation

🔍

Scanne deine Codebasis nach Inadequate Encryption Strength

Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.

npx shoulder trust Alle Regeln durchsuchen