CWE - CWE-323: Reusing a Nonce, Key Pair in Encryption (2.11)

Weakness ID: 323

Abstraction: Base

Status: Incomplete

Presentation Filter:

Description

Description Summary

Nonces should be used for the present occasion and only once.

Time of Introduction

Architecture and Design

Applicable Platforms

Languages

All

Common Consequences

Scope	Effect
Access Control	Technical Impact: Bypass protection mechanism; Gain privileges / assume identity Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.

Likelihood of Exploit

High

Demonstrative Examples

Example 1

This code takes a password, concatenates it with a nonce, then encrypts it before sending over a network:

(Bad Code)

Example Language: C

void encryptAndSendPassword(char *password){

char *nonce = "bad";

...

char *data = (unsigned char*)malloc(20);

int para_size = strlen(nonce) + strlen(password);

char *paragraph = (char*)malloc(para_size);

SHA1((const unsigned char*)paragraph,parsize,(unsigned char*)data);

sendEncryptedData(data)

}

Because the nonce used is always the same, an attacker can impersonate a trusted party by intercepting and resending the encrypted password. This attack avoids the need to learn the unencrypted password.

Example 2

This code sends a command to a remote server, using an encrypted password and nonce to prove the command is from a trusted party:

(Bad Code)

Example Language: C++

String command = new String("some command to execute");

MessageDigest nonce = MessageDigest.getInstance("SHA");

nonce.update(String.valueOf("bad nonce"));

byte[] nonce = nonce.digest();

MessageDigest password = MessageDigest.getInstance("SHA");

password.update(nonce + "secretPassword");

byte[] digest = password.digest();

sendCommand(digest, command)

Once again the nonce used is always the same. An attacker may be able to replay previous legitimate commands or execute new arbitrary commands.

Potential Mitigations

Phase: Implementation

Refuse to reuse nonce values.

Phase: Implementation

Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.

Background Details

Nonces are often bundled with a key in a communication exchange to produce a new session key for each exchange.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Category	320	Key Management Errors	Development Concepts (primary)699
ChildOf	Weakness Base	344	Use of Invariant Value in Dynamically Changing Context	Research Concepts (primary)1000
ChildOf	Category	959	SFP Secondary Cluster: Weak Cryptography	Software Fault Pattern (SFP) Clusters (primary)888
MemberOf	View	884	CWE Cross-section	CWE Cross-section (primary)884

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
CLASP			Reusing a nonce, key pair in encryption

Content History

Submissions
Submission Date	Submitter	Organization	Source
	CLASP		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time_of_Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Background_Details, Common_Consequences, Relationships, Taxonomy_Mappings
2011-06-01	CWE Content Team	MITRE	Internal
2011-06-01	updated Common_Consequences
2012-05-11	CWE Content Team	MITRE	Internal
2012-05-11	updated Relationships
2012-10-30	CWE Content Team	MITRE	Internal
2012-10-30	updated Demonstrative_Examples, Potential_Mitigations
2014-07-30	CWE Content Team	MITRE	Internal
2014-07-30	updated Relationships


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email [email protected]. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2017, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-323: Reusing a Nonce, Key Pair in Encryption