What is Use of a Broken or Risky Cryptographic (CWE-327)?

TL;DR: Use of a Broken or Risky Cryptographic Algorithm (CWE-327) is a type of cryptographic vulnerability that occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data.

At-a-Glance

What is Use of a Broken or Risky Cryptographic Algorithm?

Use of a Broken or Risky Cryptographic Algorithm (CWE-327) is a type of cryptographic vulnerability that occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data. As defined by the MITRE Corporation under CWE-327, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures…

Quick Summary

Use of a Broken or Risky Cryptographic Algorithm (CWE-327) is a critical vulnerability that can lead to unauthorized access to sensitive data, modification of sensitive data, and hiding of activities. It occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data.

Jump to: What is Use of a Broken or Risky Cryptographic Algorithm? · Quick Summary · Use of a Broken or Risky Cryptographic Algorithm Overview · How Use of a Broken or Risky Cryptographic Algorithm Works · Business Impact of Use of a Broken or Risky Cryptographic Algorithm · Use of a Broken or Risky Cryptographic Algorithm Attack Scenario · How to Detect Use of a Broken or Risky Cryptographic Algorithm · How to Fix Use of a Broken or Risky Cryptographic Algorithm · Framework-Specific Fixes for Use of a Broken or Risky Cryptographic Algorithm · How to Ask AI to Check Your Code for Use of a Broken or Risky Cryptographic Algorithm · Use of a Broken or Risky Cryptographic Algorithm Best Practices Checklist · Use of a Broken or Risky Cryptographic Algorithm FAQ · Vulnerabilities Related to Use of a Broken or Risky Cryptographic Algorithm · References · Scan Your Own Site

Use of a Broken or Risky Cryptographic Algorithm Overview

What: Use of a Broken or Risky Cryptographic Algorithm (CWE-327) is a type of cryptographic vulnerability that occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data.

Why it matters: The use of a broken or risky cryptographic algorithm can lead to unauthorized access to sensitive data, modification of sensitive data, and hiding of activities. If the cryptographic algorithm is used to ensure the identity of the source of the data (such as digital signatures), then a broken algorithm will compromise this scheme and the source of the data cannot be proven.

Where it occurs: Use of a Broken or Risky Cryptographic Algorithm can occur in any application that uses cryptography, including web applications, mobile applications, and enterprise software.

Who is affected: Any user who interacts with an application that uses a broken or risky cryptographic algorithm or protocol may be affected by this vulnerability.

Who is NOT affected: Users who do not interact with applications that use cryptography are not affected by this vulnerability.

How Use of a Broken or Risky Cryptographic Algorithm Works

Root Cause

Use of a Broken or Risky Cryptographic Algorithm occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data.

Attack Flow

1. The attacker sends a request to the application using a broken or risky cryptographic algorithm or protocol.
2. The application processes the request using the broken or risky cryptographic algorithm or protocol.
3. The attacker gains unauthorized access to sensitive data or modifies sensitive data.

Prerequisites to Exploit

• The application must use a broken or risky cryptographic algorithm or protocol.
• The attacker must be able to send requests to the application using the broken or risky cryptographic algorithm or protocol.

Vulnerable Code

import hashlib

def encrypt_data(data):
    return hashlib.md5(data).hexdigest()

This code uses the MD5 hash function, which is a broken and risky cryptographic algorithm. The attacker can exploit this vulnerability by sending requests to the application using the MD5 hash function.

Secure Code

import hashlib

def encrypt_data(data):
    return hashlib.sha256(data).hexdigest()

This code uses the SHA-256 hash function, which is a strong and secure cryptographic algorithm. The attacker cannot exploit this vulnerability because the SHA-256 hash function is not broken or risky.

Business Impact of Use of a Broken or Risky Cryptographic Algorithm

Confidentiality: The use of a broken or risky cryptographic algorithm can lead to unauthorized access to sensitive data, compromising confidentiality.

• Example: An attacker gains access to sensitive customer data by exploiting the vulnerability in the application’s encryption mechanism.
• Consequence: The company may face financial losses due to the breach of sensitive customer data.

Integrity: The use of a broken or risky cryptographic algorithm can lead to modification of sensitive data, compromising integrity.

• Example: An attacker modifies sensitive financial data by exploiting the vulnerability in the application’s encryption mechanism.
• Consequence: The company may face financial losses due to the incorrect modification of sensitive financial data.

Availability: The use of a broken or risky cryptographic algorithm can lead to disruption of service, compromising availability.

• Example: An attacker exploits the vulnerability in the application’s encryption mechanism, causing the application to become unavailable.
• Consequence: The company may face financial losses due to the downtime of the application.

Use of a Broken or Risky Cryptographic Algorithm Attack Scenario

1. The attacker sends a request to the application using a broken or risky cryptographic algorithm or protocol.
2. The application processes the request using the broken or risky cryptographic algorithm or protocol.
3. The attacker gains unauthorized access to sensitive data or modifies sensitive data.

How to Detect Use of a Broken or Risky Cryptographic Algorithm

Manual Testing

• Review the application’s encryption mechanism for vulnerabilities.
• Test the application’s encryption mechanism with different types of input data.
• Verify that the application’s encryption mechanism is using strong and secure cryptographic algorithms.

Automated Scanners (SAST/DAST)

• Use automated scanners to detect vulnerabilities in the application’s encryption mechanism.
• The scanners can identify potential vulnerabilities in the application’s encryption mechanism, such as the use of broken or risky cryptographic algorithms.

PenScan Detection

• PenScan scanner engines actively test for this issue.
• The scanner engines can identify potential vulnerabilities in the application’s encryption mechanism, such as the use of broken or risky cryptographic algorithms.

False Positive Guidance

• Be cautious when reviewing the results of automated scanners and manual testing, as false positives may occur.
• Verify that any detected vulnerabilities are actually present in the application’s encryption mechanism.

How to Fix Use of a Broken or Risky Cryptographic Algorithm

• Replace the broken or risky cryptographic algorithm with a stronger one.
• Ensure that the design allows one cryptographic algorithm to be replaced with another in the next generation or version.
• Carefully manage and protect cryptographic keys.

Framework-Specific Fixes for Use of a Broken or Risky Cryptographic Algorithm

Java

import java.security.MessageDigest;

public class Encryptor {
    public static String encrypt(String data) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] hashBytes = md.digest(data.getBytes());
        return bytesToHex(hashBytes);
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder();
        for (byte b : bytes) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) {
                hexString.append('0');
            }
            hexString.append(hex);
        }
        return hexString.toString();
    }
}

This code uses the SHA-256 hash function, which is a strong and secure cryptographic algorithm.

Node.js

const crypto = require('crypto');

function encrypt(data) {
    const hash = crypto.createHash('sha256');
    hash.update(data);
    return hash.digest('hex');
}

console.log(encrypt('Hello World!'));

This code uses the SHA-256 hash function, which is a strong and secure cryptographic algorithm.

Python/Django

import hashlib

def encrypt_data(data):
    return hashlib.sha256(data.encode()).hexdigest()

This code uses the SHA-256 hash function, which is a strong and secure cryptographic algorithm.

How to Ask AI to Check Your Code for Use of a Broken or Risky Cryptographic Algorithm

You can use the following prompt with an AI coding assistant: “Review the following [language] code block for potential CWE-327 Use of a Broken or Risky Cryptographic Algorithm vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

Use of a Broken or Risky Cryptographic Algorithm Best Practices Checklist

✅ Use strong, up-to-date cryptographic algorithms to encrypt sensitive data. ✅ Select well-vetted algorithms that are currently considered to be strong by experts in the field. ✅ Use well-tested implementations.

Use of a Broken or Risky Cryptographic Algorithm FAQ

How does Use of a Broken or Risky Cryptographic Algorithm occur?

Use of a Broken or Risky Cryptographic Algorithm (CWE-327) occurs when an application uses a broken or risky cryptographic algorithm or protocol, compromising the confidentiality and integrity of sensitive data.

What are the consequences of using a broken or risky cryptographic algorithm?

The use of a broken or risky cryptographic algorithm can lead to unauthorized access to sensitive data, modification of sensitive data, and hiding of activities. If the cryptographic algorithm is used to ensure the identity of the source of the data (such as digital signatures), then a broken algorithm will compromise this scheme and the source of the data cannot be proven.

How do I detect Use of a Broken or Risky Cryptographic Algorithm in my application?

You can use manual testing, automated scanners (SAST/DAST), PenScan detection, and review code reviews to detect Use of a Broken or Risky Cryptographic Algorithm in your application.

What are the best practices for preventing Use of a Broken or Risky Cryptographic Algorithm?

The best practices for preventing Use of a Broken or Risky Cryptographic Algorithm include using strong, up-to-date cryptographic algorithms to encrypt sensitive data, selecting well-vetted algorithms that are currently considered to be strong by experts in the field, and using well-tested implementations.

How do I fix Use of a Broken or Risky Cryptographic Algorithm in my application?

You can fix Use of a Broken or Risky Cryptographic Algorithm by replacing the broken or risky cryptographic algorithm with a stronger one, ensuring that the design allows one cryptographic algorithm to be replaced with another in the next generation or version, and carefully managing and protecting cryptographic keys.

What are some common related weaknesses to Use of a Broken or Risky Cryptographic Algorithm?

Some common related weaknesses to Use of a Broken or Risky Cryptographic Algorithm include Protection Mechanism Failure (CWE-693) and Missing Encryption of Sensitive Data (CWE-311).

How do I ask AI to check my code for Use of a Broken or Risky Cryptographic Algorithm?

You can use the following prompt with an AI coding assistant: “Review the following [language] code block for potential CWE-327 Use of a Broken or Risky Cryptographic Algorithm vulnerabilities and rewrite it using [primary fix technique]: [paste code here].”

What are some best practices for preventing Use of a Broken or Risky Cryptographic Algorithm?

Some best practices for preventing Use of a Broken or Risky Cryptographic Algorithm include verifying return values, testing your code, and using an allowlist.

Vulnerabilities Related to Use of a Broken or Risky Cryptographic Algorithm

References

• MITRE CWE-327
• OWASP A04:2025 - Cryptographic Failures
• CAPEC CAPEC-20, CAPEC-459, CAPEC-473, CAPEC-475, CAPEC-608, CAPEC-614, CAPEC-97
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of a Broken or Risky Cryptographic Algorithm and other risks before an attacker does.