Page History

HARDCODED.AUTH

HARDCODED.KEY

HARDCODED.SALT

MISC.CRYPTOPWD.NOPADPLAIN

MISC.PWD.PLAINPLAINTRAN

Hardcoded Authentication

Hardcoded Crypto Key

Hardcoded Crypto SaltEncryption

without PaddingPlaintext Storage of Password

Plaintext Storage of PasswordTransmission of Password

586

Partially supported: reports functions that read passwords from the user or that take a password as an argument instead of prompting the user as well as insecure password erasure

CERT C: Rec. MSC18-C

Checks for:

• Constant or predictable block cipher initialization vector
• Constant or predictable cipher key

• Sensitive heap memory not cleared before release
• Uncleared sensitive data in stack
• Unsafe standard encryption function

Constant cipher key, predictable cipher key

Constant block cipher initialization vector

Sensitive data not cleared or released by memory routine

Variable in stack is not cleared and contains sensitive data

Function is not reentrant or uses a risky encryption algorithm

Encryption or decryption key is constant instead of randomized or  generated from a weak random number generator

Initialization vector is constant instead of randomizedRec. partially covered.