CWE-326Inadequate Encryption Strength

Description

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Common consequences

• Access Control,Confidentiality→Bypass Protection Mechanism,Read Application Data
  An attacker may be able to decrypt the data using brute force attacks. The attacker may have a reasonable chance of succeeding using current attack methods and resources.

Potential mitigations

• Architecture and Design
  Use an encryption scheme that is currently considered to be strong by experts in the field.

Related CWEs

Recent CVEs classified under this CWE