Crypto Weaknesses¶
PostQ identifies supported cryptographic weaknesses in source code and maps them to Common Weakness Enumeration (CWE) identifiers. The identifier describes the kind of problem; the reported source, operation, and settings explain why it applies to a particular result.
Result meanings¶
| Result | Meaning |
|---|---|
CWE_REPORTED |
One or more supported weakness checks identified a problem. Review each listed CWE and its evidence. |
NO_CWE_REPORTED |
No CWE was reported by the available checks. This does not mean every possible weakness was checked or ruled out. |
A compact view may show a dash when no CWE detail is reported. It is not an approval of the cryptography. Quantum exposure, FIPS source results, and review gaps remain separate.
Supported weakness types¶
These checks apply to supported libraries and source patterns when the required evidence is available. A language appearing in the support list does not imply that every check applies to every API in that language.
| CWE | Weakness area | What PostQ identifies in supported source |
|---|---|---|
| CWE-295 | Certificate validation | Settings that disable certificate verification or make it optional in covered contexts. |
| CWE-319 | Cleartext communication | Explicit cleartext HTTP or WebSocket configuration. This describes source settings, not observed network traffic. |
| CWE-321 | Hardcoded cryptographic key | Literal key or secret material used in a supported cryptographic operation. |
| CWE-326 | Insufficient strength | Key sizes or authentication-tag lengths below an applicable supported minimum. |
| CWE-327 | Risky cryptographic algorithm | Supported weak or broken non-hash algorithms and symmetric encryption in ECB mode. |
| CWE-328 | Weak hash | Supported uses of weak hashes, including applicable signature hash components. A hash name alone does not make every MAC use a weakness. |
| CWE-329 | Predictable CBC IV | A fixed literal initialization vector used for CBC encryption. |
| CWE-337 | Predictable random seed | A fixed literal seed supplied to a supported pseudorandom generator. |
| CWE-338 | Weak randomness | A non-cryptographic random generator used in a supported security-sensitive context. |
| CWE-757 | Insecure protocol settings | Explicit obsolete SSL/TLS choices or weak configured cipher settings in covered APIs. |
| CWE-759 | Missing password salt | An explicitly absent salt in a supported password-derivation call. |
| CWE-760 | Predictable password salt | A fixed literal salt in supported password derivation. |
| CWE-780 | RSA encryption padding | Supported RSA encryption or key-transport use with PKCS#1 v1.5 or raw/no-padding choices instead of OAEP. |
| CWE-916 | Insufficient password work | Password-derivation settings below supported work requirements, or selected legacy Spring password encoders. |
| CWE-1204 | Predictable encryption IV or nonce | A fixed literal IV or nonce used in supported non-CBC encryption, including GCM, CTR, CCM, EAX, OCB, CFB, or OFB. |
Evidence matters¶
PostQ distinguishes the value of a setting from an expression whose value is unknown. An unresolved key is not automatically a hardcoded key, and literal public-key material is not automatically a secret. Fixed-IV encryption checks require evidence of the encryption use; setup or decryption alone is not the same finding.
Numeric checks cover specific security conditions. A minimum-size check is not a complete validation of every size accepted by the algorithm or library. Review units and the reported condition before deciding on a correction.
What this assessment does not establish¶
This is focused cryptographic source review, not a complete application-security assessment. It does not comprehensively prove nonce uniqueness across messages, entropy at runtime, constant-time execution, resistance to side channels, correct handling of every verification result, or protection of secrets in storage and logs. It is not a dependency-vulnerability scan.
For each reported weakness, confirm the affected use, review the suggested remediation, and test the application's behavior after a change. See Interpret Results for the review sequence and Languages and Libraries Supported for coverage boundaries.