Page History

HARDCODED.AUTH

HARDCODED.KEY

HARDCODED.SALT

MISC.CRYPTOPWD.NOPADPLAIN

MISC.PWD.PLAINPLAINTRAN

Hardcoded Authentication

Hardcoded Crypto Key

Hardcoded Crypto SaltEncryption

without PaddingPlaintext Storage of Password

Plaintext Storage Transmission of Password

586

Partially supported: reports functions that read passwords from the user or that take a password as an argument instead of prompting the user as well as insecure password erasure

CERT C: Rec. MSC18-C

Checks for:

• Constant or predictable

Sensitive heap memory not cleared before release

Uncleared sensitive data in stack

Unsafe standard encryption function

Constant cipher key

• block cipher initialization vector

• Constant or predictable cipher key

Predictable block cipher initialization vector

Sensitive data not cleared or released by memory routine

Variable in stack is not cleared and contains sensitive data

Function is not reentrant or uses a risky encryption algorithm

Encryption or decryption key is constant instead of randomized or  generated from a weak random number generator

Initialization vector is constant instead of randomized

Encryption or decryption key is generated from a weak random number generator

Initialization vector is generated from a weak random number generator

• Sensitive heap memory not cleared before release
• Uncleared sensitive data in stack
• Unsafe standard encryption function

Rec. partially covered.