CWE-323

Reusing a Nonce, Key Pair in Encryption

Base

Incomplete

Nonces should be used for the present occasion and only once.

Parent Weaknesses (ChildOf)

Scope

Access Control

Impact

Bypass Protection Mechanism, Gain Privileges or Assume Identity

Implementation

Refuse to reuse nonce values.

Implementation

Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.

social networking app reuses a nonce/key pair, allowing MITM attackers to manipulate direct messages

Rust package reuses a nonce/key pair when an object is cloned, which resets the random number generation

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.