New Risk - Weak Encryption [weak-encryption]

[cpholguera]

Description

Create a new risk for "Weak Encryption (MASVS-CRYPTO-1)" using the following information:

The use of outdated encryption methods like DES and 3DES may compromise data confidentiality and integrity.

Create "risks/MASVS-CRYPTO/1-***-****/weak-encryption/risk.md" including the following content:

---
title: Weak Encryption
alias: weak-encryption
platform: [android, ios]
profiles: [L1, L2]
mappings:
  masvs-v1: [MSTG-CRYPTO-4]
  masvs-v2: [MASVS-CRYPTO-1]
  mastg-v1: [MASTG-TEST-0014]

---

## Overview

## Impact

## Modes of Introduction

## Mitigations

To complete the sections follow the guidelines from Writing MASTG Risks & Tests

Use at least the following references:

• https://support.google.com/faqs/answer/10046138?hl=en
• https://support.google.com/faqs/answer/9450925?hl=en
• https://support.google.com/faqs/answer/9450925?hl=en
• https://developer.android.com/privacy-and-security/cryptography#deprecated-functionality
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf

When creating the corresponding tests, use the following areas to guide you:

• Weak encryption algorithms (e.g. DES, 3DES, etc.)
• Weak encryption modes (e.g. ECB, etc.)
• Cipher.getInstance("AES") defaults to ECB (Android)

MASTG v1 Refactoring:

If the risk has a MASVS v1 ID, you can use it to search for related tests in the MASTG and use them as input to define your risks and associated tests.

• MASTG-TEST-0014 - Testing the Configuration of Cryptographic Standard Algorithms (android)

Acceptance Criteria

• The risk has been created in the correct directory (risks/MASVS-CRYPTO/1-***-****/weak-encryption/risk.md)
• The risk content follows the guidelines
• At least one GitHub Issue has been created for the corresponding tests (derived from "Modes of Introduction")
• The risk indicates the related MASTG v1 tests in its metadata.