Inadequate Encryption Strength (CWE-326)

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Using encryption with insufficient key lengths or deprecated algorithms provides a false sense of security. Attackers with sufficient resources can break weak encryption.

Prevalencia

Media

1 lenguajes cubiertos

Impacto

Alto

2 reglas de severidad alta

Prevención

Documentada

2 ejemplos de corrección

2 Prevención

Cómo corregir esta vulnerabilidad

🐍 Python Ver todo Python detalles →

JWT Signed with Weak Secret HIGH

Use strong secrets from environment variables for JWT signing, never hardcode

+6 -3 python

  import jwt
- 
- def create_token(user_id):
-     return jwt.encode({'user_id': user_id}, 'secret', algorithm='HS256')
+ import os
+ 
+ SECRET_KEY = os.environ['JWT_SECRET_KEY']
+ 
+ def create_token(user_id):
+     return jwt.encode({'user_id': user_id}, SECRET_KEY, algorithm='HS256')

Weak Cryptographic Key Generation HIGH

Use RSA 2048+ bits or AES-256 with cryptographically secure key generation

+1 -1 python

  from Crypto.PublicKey import RSA
  
- key = RSA.generate(1024)
+ key = RSA.generate(2048)

3 Detección

Encuentra vulnerabilidades en tu código

Usa Shoulder para escanear tu código en busca de patrones Inadequate Encryption Strength. 2 reglas.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=326

# Or scan entire project
npx @shoulderdev/cli trust .

Reglas de Detección (2)

🐍 Python 2 rules

JWT Signed with Weak Secret HIGH

Detects JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced.

Weak Cryptographic Key Generation HIGH

Detects weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithms. Cryptographic keys must be sufficiently long and generated with secure random sources.

4 Señales de Alerta

Qué buscar en las revisiones de código

Estos patrones indican vulnerabilidades potenciales de Inadequate Encryption Strength. Búscalos durante las revisiones de código y auditorías de seguridad.

🟠

JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced python-jwt-weak-secret

🟠

weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithm python-weak-key-generation

🔍

Escanea tu base de código para Inadequate Encryption Strength

Shoulder CLI encuentra patrones vulnerables en toda tu base de código.

npx shoulder trust Ver todas las reglas