There are several areas in which cryptographic vulnerabilities can be introduced.

Length extension attacks are inherent to hash functions using Merkle–Damgård.

Heartbleed was a vulnerability caused by the specific implementation of a protocol.

Using weak ciphers such as DES is a configuration issue.

Is there a formal taxonomy for issues such as this, to make communicating issues easier?

  • 1
    $\begingroup$ I would't call it formal, but CWE is established, extensive, and fairly widely used. $\endgroup$ Feb 1, 2018 at 21:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.