Broken Cryptography

What it is

CWE-327 covers the use of cryptographic algorithms that are known to be broken (DES, MD4), known to be unsuitable for the use case (MD5 for password hashing, ECB mode for encryption), or used incorrectly (predictable IVs, missing authentication on ciphertexts).

Why it matters

Broken cryptography is one of the most frequently-cited weaknesses in regulatory enforcement actions. PCI-DSS, HIPAA, FedRAMP, and CMMC all require specific algorithm and key-strength minimums. Use of MD5 or SHA-1 for password hashing has been the root cause of multiple credential-stuffing follow-on attacks because attackers can crack the hashes offline.

Common patterns

• Password hashing with MD5, SHA-1, SHA-256, or other fast hashes instead of bcrypt, argon2, scrypt, or PBKDF2.
• Symmetric encryption with ECB mode (visible patterns) or CBC without HMAC (padding oracle).
• Hardcoded IVs or using zero IVs.
• Weak random number generation (Math.random, rand(), time-seeded PRNGs) for cryptographic purposes.
• DES, 3DES, RC4, or Blowfish in new code.
• Custom or in-house cryptography ('rolled their own crypto').

Languages affected

Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C#

What Deva detects

Deva matches algorithm names, mode constructors, and library calls. The scanner flags hashlib.md5/sha1 used with password-like variables, javax.crypto.Cipher.getInstance with 'DES', 'RC4', or '/ECB/' modes, hardcoded byte arrays passed as IVs, and use of Math.random where the value is used as a token or salt. The fix recommendation depends on context: bcrypt/argon2 for passwords, AES-GCM (or ChaCha20-Poly1305) for symmetric encryption, ECDSA P-256 or Ed25519 for signing.

Example

Vulnerable

import hashlib

def hash_password(password):
    return hashlib.sha256(password.encode()).hexdigest()

Fixed

from passlib.hash import argon2

def hash_password(password: str) -> str:
    return argon2.hash(password)

def verify_password(password: str, stored_hash: str) -> bool:
    return argon2.verify(password, stored_hash)

SHA-256 is a fast cryptographic hash. Modern GPUs compute billions of SHA-256 hashes per second. Once an attacker exfiltrates the hashed-password table, they can crack typical passwords offline in hours. argon2 (the current best practice, recommended by OWASP) is purposefully slow and memory-hard, raising the offline cracking cost by orders of magnitude. bcrypt and scrypt are also acceptable.

Where this fits in OWASP Top 10

• A04 Cryptographic FailuresSensitive data exposed because cryptography is missing, weak, or misused.

Compliance framework mapping

Related CWEs

• CWE-326 · Inadequate encryption strength.
• CWE-338 · Use of cryptographically weak PRNG.
• CWE-759 · Use of a one-way hash without a salt.
• CWE-916 · Use of password hash with insufficient computational effort.