Cryptography (CRQ)

The card is related to protection of master cryptographic secrets, within the application and more widely in management processes.

Scenario: Artim’s Access to Master Cryptographic Secrets

Imagine a scenario where Artim, exploiting weaknesses in cryptographic secret management, gains access to or predicts the master cryptographic secrets of a system. This vulnerability arises from:

1. Inadequate Protection of Master Secrets: The central cryptographic keys or secrets, which secure the entire system, are not adequately safeguarded.
2. Predictability of Secrets: The master secrets are generated or stored in a way that makes them susceptible to prediction or deduction.

Example

Artim discovers that a financial application uses a master cryptographic key for securing user transactions and data encryption. However, this key is stored in a poorly secured server repository and is generated using a predictable algorithm. Exploiting these weaknesses, Artim gains access to the repository and uses his knowledge of the algorithm to predict the master key. With this key, he decrypts sensitive user data and manipulates transaction processes.

Threat Modeling

STRIDE

That scenario clearly maps to Information Disclosure in STRIDE.

The primary violation is exposure of sensitive credentials (database passwords, API keys, service credentials). Once Justin can read those secrets, he can then leverage them for further attacks (like Tampering, Elevation of Privilege, etc.), but the root threat is that information that should have been protected is disclosed in plaintext or source code.

What can go wrong?

Access to master cryptographic secrets can lead to widespread system compromise, unauthorized data access, and the potential decryption of sensitive information.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

1. Secure master cryptographic secrets with the highest level of protection, including physical and logical security measures.
2. Utilize strong, non-predictable algorithms for generating master secrets and ensure they are stored in highly secure, access-controlled environments.
3. Regularly rotate and update master secrets while keeping backups and recovery processes secure and confidential.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.