What is Missing Cryptographic Step (CWE-325)?

TL;DR: Missing Cryptographic Step (CWE-325) occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised. This can be fixed by implementing secure cryptographic algorithms, validating user input, and enforcing access controls.

At-a-Glance Table

What is Missing Cryptographic Step?

Missing Cryptographic Step (CWE-325) is a type of cryptographic failure that occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. As defined by the MITRE Corporation under CWE-325, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures…

Quick Summary

Missing Cryptographic Step (CWE-325) occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised. This can lead to confidentiality breaches, integrity violations, and availability disruptions.

Jump to: What is Missing Cryptographic Step? · Quick Summary · Missing Cryptographic Step Overview · How Missing Cryptographic Step Works · Business Impact of Missing Cryptographic Step · Missing Cryptographic Step Attack Scenario · How to Detect Missing Cryptographic Step · How to Fix Missing Cryptographic Step · Framework-Specific Fixes for Missing Cryptographic Step · How to Ask AI to Check Your Code for Missing Cryptographic Step · Missing Cryptographic Step Best Practices Checklist · Missing Cryptographic Step FAQ · Vulnerabilities Related to Missing Cryptographic Step · References · Scan Your Own Site

Missing Cryptographic Step Overview

What: Missing Cryptographic Step (CWE-325) occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised.

Why it matters: This vulnerability can lead to confidentiality breaches, integrity violations, and availability disruptions.

Where it occurs: Missing Cryptographic Step can occur in any application that uses cryptography.

Who is affected: Any user of the affected application may be impacted by this vulnerability.

Who is NOT affected: Applications that do not use cryptography are not affected by this vulnerability.

How Missing Cryptographic Step Works

Root Cause

Missing Cryptographic Step occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised.

Attack Flow

1. An attacker identifies a vulnerable application.
2. The attacker exploits the vulnerability to gain access to sensitive data.
3. The attacker uses the gained access to compromise the confidentiality, integrity, or availability of the affected system.

Prerequisites to Exploit

• A vulnerable application must be present.
• The attacker must have knowledge of the specific cryptographic algorithm used by the application.
• The attacker must have access to the affected system.

Vulnerable Code

#include <stdio.h>
#include <string.h>

void encrypt(char *input, char *key) {
  // Missing step in cryptographic algorithm
}

int main() {
  char input[] = "Sensitive data";
  char key[] = "Weak encryption key";

  encrypt(input, key);

  return 0;
}

The vulnerable code above demonstrates a missing step in the cryptographic algorithm used to protect sensitive data.

Secure Code

#include <stdio.h>
#include <string.h>

void encrypt(char *input, char *key) {
  // Implement secure cryptographic algorithm
}

int main() {
  char input[] = "Sensitive data";
  char key[] = "Strong encryption key";

  encrypt(input, key);

  return 0;
}

The secure code above demonstrates a secure implementation of the cryptographic algorithm used to protect sensitive data.

Business Impact of Missing Cryptographic Step

Confidentiality: Sensitive data may be compromised due to weak encryption.

Integrity: Data may be modified or tampered with due to weak encryption.

Availability: Systems may become unavailable due to compromises in confidentiality and integrity.

Real-world business consequences include:

• Financial losses due to data breaches
• Compliance issues due to non-adherence to regulatory requirements
• Reputation damage due to compromised sensitive data

Missing Cryptographic Step Attack Scenario

1. An attacker identifies a vulnerable application.
2. The attacker exploits the vulnerability to gain access to sensitive data.
3. The attacker uses the gained access to compromise the confidentiality, integrity, or availability of the affected system.

How to Detect Missing Cryptographic Step

Manual Testing

• Review application code for missing steps in cryptographic algorithms
• Test application with known vulnerabilities to identify potential issues
• Perform regular security audits to detect vulnerabilities

Automated Scanners (SAST / DAST)

• Static analysis tools can detect missing steps in cryptographic algorithms.
• Dynamic analysis tools can simulate attacks on the application to identify potential vulnerabilities.

PenScan Detection

PenScan’s automated scan can detect Missing Cryptographic Step vulnerabilities and provide recommendations for remediation.

False Positive Guidance

Be cautious when detecting potential vulnerabilities, as some may be false positives. Always verify findings with additional testing or manual review.

How to Fix Missing Cryptographic Step

• Implement secure cryptographic algorithms
• Validate user input to prevent attacks on the algorithm
• Enforce access controls to limit exposure of sensitive data

Framework-Specific Fixes for Missing Cryptographic Step

Java

import javax.crypto.Cipher;
import java.security.Key;

public class SecureEncryption {
  public static void main(String[] args) throws Exception {
    Key key = KeyGenerator.getInstance("AES").generateKey();
    Cipher cipher = Cipher.getInstance("AES");
    cipher.init(Cipher.ENCRYPT_MODE, key);
    byte[] encryptedData = cipher.doFinal(input.getBytes());
  }
}

Node.js

const crypto = require('crypto');

function encrypt(data) {
  const key = crypto.randomBytes(32).toString('hex');
  const iv = crypto.randomBytes(16).toString('hex');
  const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(key, 'hex'), Buffer.from(iv, 'hex'));
  let encryptedData = cipher.update(data);
  encryptedData = Buffer.concat([encryptedData, cipher.final()]);
  return { key, iv, encryptedData };
}

Python/Django

from cryptography.fernet import Fernet

def encrypt(data):
  key = Fernet.generate_key()
  cipher_suite = Fernet(key)
  encrypted_data = cipher_suite.encrypt(data.encode())
  return key, encrypted_data

PHP

function encrypt($data) {
  $key = openssl_random_pseudo_bytes(32);
  $iv = openssl_random_pseudo_bytes(16);
  $cipher = openssl_encrypt($data, 'aes-256-cbc', $key, 0, $iv);
  return array($key, $iv, $cipher);
}

How to Ask AI to Check Your Code for Missing Cryptographic Step

Review the following [language] code block for potential CWE-325 Missing Cryptographic Step vulnerabilities and rewrite it using [primary fix technique]: [paste code here]

Missing Cryptographic Step Best Practices Checklist

✅ Implement secure cryptographic algorithms ✅ Validate user input to prevent attacks on the algorithm ✅ Enforce access controls to limit exposure of sensitive data ✅ Regularly review and update cryptographic protocols ✅ Use secure key management practices

Missing Cryptographic Step FAQ

How does Missing Cryptographic Step occur?

Missing Cryptographic Step occurs when a product doesn’t implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised.

What are the common consequences of Missing Cryptographic Step?

The common consequences of Missing Cryptographic Step include confidentiality breaches, integrity violations, and availability disruptions.

How can I detect Missing Cryptographic Step vulnerabilities?

You can use PenScan’s automated scan to detect Missing Cryptographic Step vulnerabilities or perform manual testing using the provided checklist.

What are the potential mitigations for Missing Cryptographic Step?

The potential mitigations for Missing Cryptographic Step include implementing secure cryptographic algorithms, validating user input, and enforcing access controls.

How can I prevent Missing Cryptographic Step vulnerabilities in my application?

You can use PenScan’s recommendations to implement secure cryptographic algorithms, validate user input, and enforce access controls.

What are the related weaknesses to Missing Cryptographic Step?

The related weaknesses to Missing Cryptographic Step include CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation), CWE-573 (Improper Following of Specification by Caller), and CWE-358 (Improperly Implemented Security Check for Standard).

What are the attack patterns related to Missing Cryptographic Step?

The attack patterns related to Missing Cryptographic Step include CAPEC-68.

Vulnerabilities Related to Missing Cryptographic Step

References

• MITRE CWE-325
• OWASP A04:2025 - Cryptographic Failures
• CAPEC-68
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Missing Cryptographic Step and other risks before an attacker does.