Description

Create a new risk for "Weak Cryptographic Key Generation (MASVS-CRYPTO-2)" using the following information:

e.g. 1024-bit RSA keys, 128-bit AES keys*, 160-bit ECDSA keys, 80-bit symmetric keys

Note about 128-bit AES keys: See "Symmetric algorithm key lengths" in https://en.wikipedia.org/wiki/Key_size

The Advanced Encryption Standard published in 2001 uses key sizes of 128, 192 or 256 bits. Many observers consider 128 bits sufficient for the foreseeable future for symmetric algorithms of AES's quality until quantum computers become available. However, as of 2015, the U.S. National Security Agency has issued guidance that it plans to switch to quantum computing resistant algorithms and now requires 256-bit AES keys for data classified up to Top Secret.

Create "risks/MASVS-CRYPTO/2-***-****/weak-crypto-key-generation/risk.md" including the following content:

---
title: Weak Cryptographic Key Generation
alias: weak-crypto-key-generation
platform: [android, ios]
profiles: [L1, L2]
mappings:
  masvs-v1: [MSTG-CRYPTO-2]
  masvs-v2: [MASVS-CRYPTO-2]
  mastg-v1: [MASTG-TEST-0061, MASTG-TEST-0014]

---

## Overview

## Impact

## Modes of Introduction

## Mitigations

To complete the sections follow the guidelines from Writing MASTG Risks & Tests

Use at least the following references:

• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r1.pdf

When creating the corresponding tests, use the following areas to guide you:

• insufficient Key Length

MASTG v1 Refactoring:

If the risk has a MASVS v1 ID, you can use it to search for related tests in the MASTG and use them as input to define your risks and associated tests.

• MASTG-TEST-0061 - Verifying the Configuration of Cryptographic Standard Algorithms (ios)
• MASTG-TEST-0014 - Testing the Configuration of Cryptographic Standard Algorithms (android)

Acceptance Criteria

• The risk has been created in the correct directory (risks/MASVS-CRYPTO/2-***-****/weak-crypto-key-generation/risk.md)
• The risk content follows the guidelines
• At least one GitHub Issue has been created for the corresponding tests (derived from "Modes of Introduction")
• The risk indicates the related MASTG v1 tests in its metadata.