Inadequate Encryption Strength (CWE-326)

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Using encryption with insufficient key lengths or deprecated algorithms provides a false sense of security. Attackers with sufficient resources can break weak encryption.

Prevalência

Média

1 linguagens cobertas

Impacto

Alto

2 regras de severidade alta

Prevenção

Documentada

2 exemplos de correção

2 Prevenção

Como corrigir esta vulnerabilidade

🐍 Python Ver tudo Python detalhes →

JWT Signed with Weak Secret HIGH

Use strong secrets from environment variables for JWT signing, never hardcode

+6 -3 python

  import jwt
- 
- def create_token(user_id):
-     return jwt.encode({'user_id': user_id}, 'secret', algorithm='HS256')
+ import os
+ 
+ SECRET_KEY = os.environ['JWT_SECRET_KEY']
+ 
+ def create_token(user_id):
+     return jwt.encode({'user_id': user_id}, SECRET_KEY, algorithm='HS256')

Weak Cryptographic Key Generation HIGH

Use RSA 2048+ bits or AES-256 with cryptographically secure key generation

+1 -1 python

  from Crypto.PublicKey import RSA
  
- key = RSA.generate(1024)
+ key = RSA.generate(2048)

3 Detecção

Encontre vulnerabilidades no seu código

Use o Shoulder para escanear seu código em busca de padrões Inadequate Encryption Strength. 2 regras.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=326

# Or scan entire project
npx @shoulderdev/cli trust .

Regras de Detecção (2)

🐍 Python 2 rules

JWT Signed with Weak Secret HIGH

Detects JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced.

Weak Cryptographic Key Generation HIGH

Detects weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithms. Cryptographic keys must be sufficiently long and generated with secure random sources.

4 Sinais de Alerta

O que observar nas revisões de código

Estes padrões indicam vulnerabilidades potenciais de Inadequate Encryption Strength. Procure-os durante revisões de código e auditorias de segurança.

🟠

JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced python-jwt-weak-secret

🟠

weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithm python-weak-key-generation

🔍

Escaneie seu código para Inadequate Encryption Strength

O Shoulder CLI encontra padrões vulneráveis em todo o seu código.

npx shoulder trust Ver todas as regras