Insufficient Cryptography

Weak algorithms, hardcoded keys and static IVs, insecure randomness, trivial key derivation, and homegrown “encryption”.

10 vulnerabilities. OWASP Mobile: M10

Vulnerability	ID	Platform	Difficulty	OWASP	MASVS	MASWE	MASTG (v2)	CWE
Hardcoded Keys & Static IVs	`hardcoded_keys_ivs`	AndroidiOS	EASY	M10	MASVS-CRYPTO-1 MASVS-CRYPTO-2	MASWE-0004 MASWE-0007	MASTG-TEST-0212 MASTG-TEST-0214 MASTG-TEST-0309 MASTG-TEST-0310	CWE-321 CWE-329
Weak Cryptographic Algorithms (MD5/SHA1/DES/RC4/ECB)	`weak_algorithms`	AndroidiOS	EASY	M10	MASVS-CRYPTO-1	MASWE-0007 MASWE-0008	MASTG-TEST-0210 MASTG-TEST-0221 MASTG-TEST-0232 MASTG-TEST-0317 MASTG-TEST-0211	CWE-327 CWE-328
Custom / Homegrown Crypto	`custom_crypto_implementation`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1	MASWE-0007	MASTG-TEST-0210 MASTG-TEST-0221	CWE-327
Device Secure Lock Not Enforced for Sensitive Storage	`device_secure_lock_not_enforced`	AndroidiOS	MEDIUM	M9	MASVS-CRYPTO-2 MASVS-STORAGE-1	MASWE-0017	-	CWE-311 CWE-522
Improper MAC Verification (non-constant-time / unauthenticated)	`improper_mac_verification`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1	MASWE-0009	-	CWE-347 CWE-208
Insecure Randomness (predictable tokens/session IDs)	`insecure_random`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1	MASWE-0012	MASTG-TEST-0204 MASTG-TEST-0205 MASTG-TEST-0311 MASTG-TEST-0349	CWE-330 CWE-338
RSA Without OAEP Padding	`rsa_no_oaep_padding`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1	MASWE-0022	-	CWE-780 CWE-327
Unauthenticated Encryption (malleable ciphertext / bit-flipping)	`unauthenticated_encryption_malleable_ciphertext`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1 MASVS-CRYPTO-2	MASWE-0021	-	CWE-353 CWE-326
Weak Key Derivation (no/low PBKDF2 iterations)	`weak_key_derivation`	AndroidiOS	MEDIUM	M10	MASVS-CRYPTO-1	MASWE-0014	-	CWE-916 CWE-327
Improper Signature Verification (payload not bound)	`improper_signature_verification`	AndroidiOS	HARD	M10	MASVS-CRYPTO-1	MASWE-0011	-	CWE-347