Encryption only protects data if the algorithm, mode, key, and randomness are all sound. Apps that use ECB mode, MD5 or SHA-1, static IVs, or keys embedded in the binary give a false sense of security: an attacker who reverse engineers the app can decrypt everything it protects.
Use platform-provided, well-reviewed crypto APIs with modern algorithms (AES-GCM, ChaCha20-Poly1305, SHA-256+), generate keys in hardware-backed keystores, never hardcode keys, use cryptographically secure random number generators, and plan for key rotation.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#10mobile10-2024 Insufficient Cryptography
