Inadequate Encryption Strength (CWE-326)

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Using encryption with insufficient key lengths or deprecated algorithms provides a false sense of security. Attackers with sufficient resources can break weak encryption.

Prevalence

Medium

1 languages covered

Impact

High

2 high-severity rules

Prevention

Documented

2 fix examples

2 Prevention

How to fix this vulnerability

🐍 Python View all Python details →

JWT Signed with Weak Secret HIGH

Use strong secrets from environment variables for JWT signing, never hardcode

+6 -3 python

  import jwt
- 
- def create_token(user_id):
-     return jwt.encode({'user_id': user_id}, 'secret', algorithm='HS256')
+ import os
+ 
+ SECRET_KEY = os.environ['JWT_SECRET_KEY']
+ 
+ def create_token(user_id):
+     return jwt.encode({'user_id': user_id}, SECRET_KEY, algorithm='HS256')

Weak Cryptographic Key Generation HIGH

Use RSA 2048+ bits or AES-256 with cryptographically secure key generation

+1 -1 python

  from Crypto.PublicKey import RSA
  
- key = RSA.generate(1024)
+ key = RSA.generate(2048)

3 Detection

Find vulnerabilities in your code

Use Shoulder to scan your codebase for Inadequate Encryption Strength patterns. 2 rules.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=326

# Or scan entire project
npx @shoulderdev/cli trust .

Detection Rules (2)

🐍 Python 2 rules

JWT Signed with Weak Secret HIGH

Detects JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced.

Weak Cryptographic Key Generation HIGH

Detects weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithms. Cryptographic keys must be sufficiently long and generated with secure random sources.

4 Warning Signs

What to watch for in code reviews

These patterns indicate potential Inadequate Encryption Strength vulnerabilities. Look for these during code reviews and security audits.

🟠

JWT tokens signed with weak, hardcoded, or default secret keys that can be brute-forced python-jwt-weak-secret

🟠

weak cryptographic key generation: insufficient key sizes, predictable keys, or using weak algorithm python-weak-key-generation

🔍

Scan your codebase for Inadequate Encryption Strength

Shoulder CLI finds vulnerable patterns across your entire codebase.

npx shoulder trust Browse all rules