Issue Details
Insufficient Cryptography
mobile05 • Rank #5 in OWASP 2024
Explanation
Insufficient cryptography includes weak algorithms, poor key management, custom crypto implementations, and hardcoded keys. Mobile apps often use cryptography for data protection, secure communication, and authentication. Weak crypto undermines all these protections and enables data recovery by attackers.
Remedy
Use platform-provided cryptographic APIs with strong algorithms (AES-256, RSA-2048+, ECDSA). Avoid custom crypto implementations. Use secure key management through Keychain/Keystore. Keep cryptographic libraries updated and avoid deprecated algorithms like MD5, SHA-1, or DES.
| Year | Rank | Category |
|---|---|---|
| 2016 | #5 | mobile05 - Insufficient Cryptography |
| 2024 | #5 | mobile05 - Client-Side Injection and Code Execution |