Insufficient cryptography includes weak algorithms, poor key management, custom crypto implementations, and hardcoded keys. Mobile apps often use cryptography for data protection, secure communication, and authentication. Weak crypto undermines all these protections and enables data recovery by attackers.
Use platform-provided cryptographic APIs with strong algorithms (AES-256, RSA-2048+, ECDSA). Avoid custom crypto implementations. Use secure key management through Keychain/Keystore. Keep cryptographic libraries updated and avoid deprecated algorithms like MD5, SHA-1, or DES.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#05mobile05-2024 Insecure Communication
No change since 20162016
#05Insufficient Cryptography
