The application contains key management weaknesses that may reduce the effectiveness of its cryptographic protections. Nonces are intended to be unique and used only once for a given cryptographic operation, but reuse of a nonce or nonce/key pair can allow attackers to replay previously captured messages or impersonate trusted users. Additionally, cryptographic keys or passwords that remain in use beyond their intended expiration period increase the window of opportunity for compromise, cracking, or unauthorised reuse.

These issues can undermine authentication, message integrity, and encryption guarantees, particularly where encrypted messages, signed requests, session material, or trusted commands rely on nonce uniqueness and valid key lifetimes. If an attacker can capture and replay valid encrypted data, or exploit stale cryptographic material, they may be able to bypass security controls, assume identity, or perform unauthorised actions.

Remediation

Ensure all cryptographic nonces are unique and never reused with the same key. Use secure nonce generation strategies such as cryptographically secure random values, monotonic counters, timestamps with replay protection, or challenge-response mechanisms where appropriate. Cryptographic keys, certificates, and passwords should have clearly defined expiration periods and should be rotated before expiry. The application should reject expired keys or certificates and provide a safe key rotation process to avoid continued use of stale cryptographic material.

Metadata

• Severity: high
• Slug: key-management-errors

CWEs

• 323: Reusing a Nonce, Key Pair in Encryption
• 324: Use of a Key Past its Expiration Date
• 284: Improper Access Control

OWASP

• A01:2021: Broken Access Control
• SC01:2025: Access Control Vulnerabilities
• A02:2021: Cryptographic Failures