A04: Cryptographic Failures

Cryptographic Failures occur when sensitive data is not properly protected using encryption, hashing, or secure key management. This can lead to data exposure, unauthorized access, and integrity breaches, especially when weak encryption algorithms, improper key storage, or plaintext data transmission are involved. Attackers exploit these weaknesses to steal credentials, decrypt confidential information, or manipulate encrypted data.

Common Vulnerabilities:

• Use of Weak or Deprecated Cryptographic Algorithms (MD5, SHA-1, DES, RC4)
• Sensitive Data Exposed Because It Is Stored or Transmitted Without Encryption
• Transmission of Data Over Unencrypted Channels (Missing HTTPS/TLS, Missing HSTS)
• Insecure or Hardcoded Cryptographic Keys
• Lack of Proper Key Management (Reusing or Exposing Keys)
• Insufficiently Random Values Used for Tokens, Session IDs, or Nonces
• Improper Implementation of Encryption (Weak Initialization Vectors, ECB Mode Usage, Broken Padding)

To mitigate these risks, applications should use strong encryption standards (AES-256, SHA-256, TLS 1.2+), enforce HTTPS for all data transmission, securely store and rotate cryptographic keys, generate random values with cryptographically secure sources, and follow best practices for hashing passwords (bcrypt, Argon2, PBKDF2). Regular security audits and compliance checks should also be conducted to ensure cryptographic integrity.

Last updated 2026-08-19