OWASP A04:2025 – Cryptographic Failures refers to security weaknesses that occur when sensitive data isn’t properly protected using the right encryption methods. This includes using outdated algorithms, weak keys, misconfigured certificates, or even storing data without encryption. These failures can expose passwords, financial information, personal data, or internal system details to attackers. In simple terms, if an organization doesn’t encrypt its sensitive data correctly, it becomes an easy target for cyber threats.
Ranked now at #4, this category highlights issues arising from missing encryption, weak or outdated cryptographic mechanisms, improper key management, and other errors connected to the incorrect use of cryptography. The core concern is that when applications use inadequate cryptographic protection, sensitive data becomes exposed or easier for attackers to exploit.
A significant portion of the CWEs associated with this risk revolve around the use of insecure or predictable random number generation, which is essential for creating secure keys, tokens, and session identifiers. The most common examples include:
• CWE-327: Use of Deprecated, Unsafe, or Compromised Cryptographic Algorithms
• CWE-331: Lack of Sufficient Entropy for Generating Secure Random Values
• CWE-1241: Use of Predictable or Non-Random Algorithms in Random Number Generators
• CWE-338: Use of Pseudo-Random Number Generators (PRNGs) That Are Not Cryptographically Strong
These weaknesses underline that poor cryptographic design, whether through outdated algorithms, insufficient randomness, or improper key handling, can create severe security gaps in applications and systems. As cryptography forms the backbone of modern data protection, any flaw in its implementation significantly increases the risk of compromise.
Description of Cryptographic Failures
Cryptographic Failures occur when applications do not properly protect sensitive information due to missing, weak, or incorrectly implemented encryption. This category covers a wide range of issues, including the use of outdated or broken cryptographic algorithms, insufficient protection for data in transit or at rest, improper key handling, and predictable random number generation.
Many systems still rely on insecure practices such as hardcoded keys, low-entropy values, obsolete encryption methods, or unencrypted communication channels. These mistakes make it easier for attackers to intercept, decrypt, or manipulate sensitive data such as passwords, tokens, financial information, and personal records.
A significant part of this risk is also tied to the misuse of cryptographic functions, particularly pseudo-random number generators (PRNGs) that fail to produce unpredictable values. When randomness is weak, attackers can predict session tokens, encryption keys, or initialization vectors, leading to full compromise of the application’s security.
Overall, Cryptographic Failures highlight the importance of using strong, modern, and properly configured cryptographic mechanisms, along with secure key management, to ensure that sensitive data remains protected throughout its entire lifecycle.
What does Cryptographic Failures mean?
Cryptographic Failures refer to security weaknesses that arise when an application does not properly protect sensitive data using strong and correctly implemented cryptography. This category focuses on the underlying root cause of data exposure — which is usually the incorrect use, absence, or misconfiguration of cryptographic controls.
In today’s digital systems, applications depend heavily on cryptography to secure confidential information such as passwords, financial data, healthcare records, personal identity information (PII), authentication tokens, and communications between clients and servers. When these cryptographic protections are weak, outdated, or incorrectly applied, attackers can intercept, decrypt, or manipulate this data with relative ease.
Cryptographic Failures include a wide range of issues. These can involve using obsolete algorithms (like MD5, SHA-1, DES), weak key sizes, or insecure protocols (such as old TLS versions). They also include design and implementation mistakes such as storing passwords in plain text, using hardcoded or reused encryption keys, failing to encrypt sensitive data at all, or generating random numbers using predictable or non-cryptographic PRNGs. Any of these mistakes weaken the security posture of the system and make it vulnerable to attacks.
Another major source of cryptographic failure is poor key management. Even if strong encryption is used, leaking keys, storing them in source code, exposing them through configuration files, or failing to rotate them can render the encryption useless. Similarly, improper certificate validation, disabling SSL checks, or accepting invalid certificates open the door for man-in-the-middle attacks.
Ultimately, Cryptographic Failures mean that the mechanisms meant to protect data are either missing, weak, or misconfigured. Instead of safeguarding information, they unintentionally create openings that attackers can exploit. Because cryptography forms the foundation of secure communication and data storage, even a small failure can lead to large-scale breaches, identity theft, financial fraud, and total compromise of sensitive systems.
How to prevent?
- Use Strong and Modern Encryption Standards : Always use up-to-date, secure algorithms like:
• AES-256
• TLS 1.3
• SHA-256 or SHA-3
Avoid outdated algorithms such as MD5, SHA-1, DES, RC4, and RSA with weak key sizes. - Enforce HTTPS/TLS for All Data in Transit : Ensure all communication (API calls, login forms, internal services) uses TLS 1.2+ or TLS 1.3.
No plaintext transmission should be allowed. - Implement Secure Key Management :
• Never hardcode keys inside code, GitHub, or config files.
• Store keys in secure vaults (AWS KMS, Azure Key Vault, HashiCorp Vault).
• Rotate keys regularly.
• Use proper access control for key usage. - Use Cryptographically Secure Random Number Generators (CSPRNGs): Avoid predictable or weak PRNGs.
Use OS-level secure random sources:
• /dev/urandom (Linux)
• Crypto.getRandomValues() (Web)
• SecureRandom (Java)
• random.SystemRandom (Python) - Hash Passwords Safely : Use strong, slow hashing algorithms designed for passwords:
• bcrypt
• Argon2
• PBKDF2
. Never store passwords in plain text or use normal hashing like SHA-256 directly. - Protect Data at Rest : Encrypt sensitive data stored in databases, backups, logs, and cloud storage using strong encryption keys.
- Avoid Custom or Homemade Cryptography : Never build your own encryption logic. Always rely on vetted industry-standard libraries and frameworks.
- Validate Certificates Properly : Ensure certificate pinning, proper certificate validation, and avoid disabling certificate checks.
- Secure Configuration of Crypto Libraries : Common mistakes include:
• Weak key sizes
• Incorrect cipher modes (e.g., ECB)
• Missing IVs or non-random IVs.
Always follow vendor documentation for secure settings. - Follow Least Privilege for Crypto Operations : Only authorized services should have access to encryption/decryption functions or cryptographic keys.
- Regular Cryptography Audits : Perform periodic reviews of:
• Encryption algorithms used
• Key storage
• Certificate configuration
• Random number generation
• Library versions - Replace Outdated Libraries : Keep crypto libraries updated and remove legacy encryption protocols and ciphers. Example attack scenarios.
Scenario 1: Weak Encryption Allows Data Theft
A company stores customer credit card numbers using DES encryption, which is outdated and easy to break. An attacker steals the encrypted database and uses widely available cracking tools to decrypt all the card numbers in minutes. The failure happened because weak, obsolete cryptography was used.
Scenario 2: Plaintext Login Over HTTP (MITM Attack)
A mobile app sends usernames and passwords through HTTP instead of HTTPS. An attacker on the same Wi-Fi network intercepts the traffic and captures the login credentials using a packet sniffer. This occurred due to lack of encryption in transit.
Scenario 3: Hardcoded Keys in Source Code
Developers accidentally commit an API encryption key to a public GitHub repository. Attackers scan GitHub for exposed secrets, find the key, and decrypt sensitive user data stored in the application. This happened because keys were not properly protected.
Scenario 4: Predictable Random Numbers (Session Hijacking)
A web application uses a non-cryptographic PRNG to generate session IDs. An attacker analyzes patterns in several IDs, predicts the next valid session token, and hijacks a logged-in user’s account. The vulnerability arises from insufficient entropy and predictable randomness.
Scenario 5: Passwords Stored in Plain Text
An internal employee gains unauthorized access to the user database and finds all passwords stored in plain text. They easily log into multiple user accounts and steal sensitive information. The root cause is lack of password hashing and encryption.
Scenario 6: Improper Certificate Validation
An application ignores SSL certificate errors. An attacker sets up a fake Wi-Fi hotspot and performs a man-in-the-middle attack with a self-signed certificate. The app accepts the fake certificate, allowing the attacker to read and modify all traffic. This occurred due to incorrect certificate handling.
Scenario 7: Reused Initialization Vectors (IVs) in Encryption
A system encrypts sensitive logs with AES-CBC but uses the same IV for every encryption operation. An attacker observes patterns in the encrypted data and partially reconstructs the original messages. The issue arises from incorrect implementation of encryption modes.
Conclusion
Cryptographic Failures remain one of the most critical security risks because they directly affect the confidentiality and integrity of sensitive data. As digital systems grow more complex and attackers become more sophisticated, organizations cannot afford to rely on outdated, weak, or improperly implemented cryptographic controls. The slightest mistake—whether it’s a predictable random number, a hardcoded key, or an old encryption algorithm—can open the door to severe breaches and long-term damage.
To stay secure, businesses must adopt modern encryption standards, enforce strict key management, validate certificates properly, and use cryptographically strong random number generators. Avoiding homemade cryptography, keeping libraries updated, and conducting regular audits are equally essential.
In a world where data protection is the backbone of trust, strong, well-implemented cryptography is not optional—it is fundamental. By prioritizing security best practices and eliminating cryptographic weaknesses, organizations can significantly reduce the chances of data exposure and fortify their systems against evolving cyber threats.
Stay informed and stay secure — follow Cyber Defentech for more cybersecurity insights and updates.
