CWE-323 — Reusing a Nonce, Key Pair in Encryption
CWE-323: Reusing a Nonce, Key Pair in Encryption
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | High |
Description
Nonces should be used for the present occasion and only once.
Common consequences
- Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
Mitigations
Implementation — Refuse to reuse nonce values.
Implementation — Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.
References
- CWE page: https://cwe.mitre.org/data/definitions/323.html
- CWE list: https://cwe.mitre.org/data/index.html