JCC logo
OWASP Risks Atlasby Jer Catallo

Issue Details

Insufficient Cryptography

mobile05 • Rank #5 in OWASP 2024

Explanation

Insufficient cryptography includes weak algorithms, poor key management, custom crypto implementations, and hardcoded keys. Mobile apps often use cryptography for data protection, secure communication, and authentication. Weak crypto undermines all these protections and enables data recovery by attackers.

Remedy

Use platform-provided cryptographic APIs with strong algorithms (AES-256, RSA-2048+, ECDSA). Avoid custom crypto implementations. Use secure key management through Keychain/Keystore. Keep cryptographic libraries updated and avoid deprecated algorithms like MD5, SHA-1, or DES.

YearRankCategory
2016#5mobile05 - Insufficient Cryptography
2024#5mobile05 - Client-Side Injection and Code Execution