diff --git a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp index 0fcbd89d8921..33561b3d1bff 100644 --- a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,11 +3,15 @@ "qhelp.dtd"> -

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

- -

Many cryptographic algorithms provided by cryptography libraries are known to be weak, or -flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted -data.

+

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

+ +

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example: +

+ diff --git a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp index 1d8e8db6798c..35b37b9f814d 100644 --- a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,11 +3,15 @@ "qhelp.dtd"> -

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

- -

Many cryptographic algorithms provided by cryptography libraries are known to be weak, or -flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted -data.

+

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

+ +

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example: +

+
    +
  • If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.
    • +
  • If a weak hashing algorithm is used to protect data integrity, an attacker may be able to craft a malicious input that has the same hash as a benign one.
    • +
  • If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users.
    • +
 diff --git a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp index e0ccf71572f7..bdd1071b6134 100644 --- a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -4,17 +4,34 @@

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example:

+
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak hashing algorithm is used to protect data integrity, an + attacker may be able to craft a malicious input that has the same + hash as a benign one. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +
+ diff --git a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp index 1b26d30e0fe6..9757f2d49bfe 100644 --- a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,20 +3,33 @@ "qhelp.dtd"> +

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example:

+
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +
+

- This query alerts on any use of a weak cryptographic algorithm, that is + This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash functions are handled by the py/weak-sensitive-data-hashing query. diff --git a/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp b/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp index cede4e735d57..cf84089e3d26 100644 --- a/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp +++ b/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp @@ -4,14 +4,33 @@

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

+ +

+ Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example: +

+ +
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + This query alerts on any use of a weak cryptographic algorithm that is + not a hashing algorithm. Use of broken or weak cryptographic hash + functions are handled by the + rb/weak-sensitive-data-hashing query.

diff --git a/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp b/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp index e24222e09fc5..0c9e8fc289dd 100644 --- a/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,20 +3,32 @@ "qhelp.dtd"> -

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. -

+

+ Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity. +

-

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. -

+

+ Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example: +

+ +
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +

- This query alerts on any use of a weak cryptographic algorithm, that is + This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash functions are handled by the rust/weak-sensitive-data-hashing query.