43 vulnerabilities classified as CWE-323 (在加密中重用Nonce与密钥对). AI Chinese analysis included.
CWE-323 represents a cryptographic weakness where developers improperly reuse nonces or key pairs in encryption operations, violating the fundamental principle that these values must be unique per session. This flaw is typically exploited by attackers who leverage the repeated cryptographic material to perform statistical analysis, recover plaintext messages, or forge valid authentication tokens. By observing patterns in ciphertexts generated with identical keys or nonces, adversaries can bypass security controls and gain unauthorized access to sensitive data. To prevent this vulnerability, developers must implement robust random number generators to create cryptographically secure, unique nonces for every encryption instance. Additionally, strict key management protocols should ensure that private keys are never reused across different contexts or sessions, thereby maintaining the integrity and confidentiality of the encrypted communication channel.
void encryptAndSendPassword(char *password){ char *nonce = "bad"; ... char *data = (unsigned char*)malloc(20); int para_size = strlen(nonce) + strlen(password); char *paragraph = (char*)malloc(para_size); SHA1((const unsigned char*)paragraph,parsize,(unsigned char*)data); sendEncryptedData(data) }String command = new String("some command to execute"); MessageDigest nonce = MessageDigest.getInstance("SHA"); nonce.update(String.valueOf("bad nonce")); byte[] nonce = nonce.digest(); MessageDigest password = MessageDigest.getInstance("SHA"); password.update(nonce + "secretPassword"); byte[] digest = password.digest(); sendCommand(digest, command)Vulnerabilities classified as CWE-323 (在加密中重用Nonce与密钥对) represent 43 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.