Inadequate Encryption Strength (CWE-326)

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Using encryption with insufficient key lengths or deprecated algorithms provides a false sense of security. Attackers with sufficient resources can break weak encryption.

Rozpowszechnienie

Średnia

Pokryto 1 języków

Wplyw

Wysoki

2 reguł o wysokim poziomie

Zapobieganie

Udokumentowane

2 przykładów poprawek

2 Zapobieganie

Jak naprawić tę podatność

🐍 Python Zobacz wszystko Python szczegóły →

JWT Signed with Weak Secret HIGH

Use strong secrets from environment variables for JWT signing, never hardcode

+6 -3 python

  import jwt
- 
- def create_token(user_id):
-     return jwt.encode({'user_id': user_id}, 'secret', algorithm='HS256')
+ import os
+ 
+ SECRET_KEY = os.environ['JWT_SECRET_KEY']
+ 
+ def create_token(user_id):
+     return jwt.encode({'user_id': user_id}, SECRET_KEY, algorithm='HS256')

Weak Cryptographic Key Generation HIGH

Use RSA 2048+ bits or AES-256 with cryptographically secure key generation

+1 -1 python

  from Crypto.PublicKey import RSA
  
- key = RSA.generate(1024)
+ key = RSA.generate(2048)

3 Wykrywanie

Znajdz podatnosci w swoim kodzie

Uzyj Shoulder do skanowania kodu w poszukiwaniu wzorcow Inadequate Encryption Strength. 2 reguly.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=326

# Or scan entire project
npx @shoulderdev/cli trust .

Reguly Wykrywania (2)

🐍 Python 2 rules

JWT Signed with Weak Secret HIGH

Detects JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced.

Weak Cryptographic Key Generation HIGH

Detects weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithms. Cryptographic keys must be sufficiently long and generated with secure random sources.

4 Sygnaly Ostrzegawcze

Na co zwracac uwage podczas przegladu kodu

Te wzorce wskazuja na potencjalne podatnosci Inadequate Encryption Strength. Szukaj ich podczas przegladow kodu i audytow bezpieczenstwa.

🟠

JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced python-jwt-weak-secret

🟠

weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithm python-weak-key-generation

🔍

Przeskanuj swój kod w poszukiwaniu Inadequate Encryption Strength

Shoulder CLI znajduje podatne wzorce w całym Twoim kodzie.

npx shoulder trust Przeglądaj wszystkie reguły