Cryptographic Operations are run Before Supporting Units are Ready

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when cryptographic processes start before their required dependencies are properly initialized and ready to supply valid data, potentially compromising security.

Extended Description

Cryptographic hardware often relies on other system components to function securely. For example, an encryption module might need a true random number generator for entropy or require keys from a secure storage unit. If crypto operations begin before these supporting units are fully operational—like reading keys from an uninitialized fuse bank or using predictable values from a not-yet-ready RNG—the cryptographic output becomes weak or predictable, undermining the entire security mechanism. Developers must implement explicit readiness checks and proper initialization sequences before invoking any cryptographic functions. This means verifying that entropy sources are producing true randomness, key storage is accessible, and all hardware dependencies are in a secure state. Failing to enforce this dependency chain creates a race condition where crypto operations execute with invalid or default inputs, leading to easily breakable encryption, weak keys, or other cryptographic failures that attackers can exploit.

Common Consequences 1
Scope: Access ControlConfidentialityIntegrityAvailabilityAccountabilityAuthenticationAuthorizationNon-Repudiation

Impact: Varies by Context

Potential Mitigations 2
Phase: Architecture and Design
Best practices should be used to design cryptographic systems.
Phase: Implementation
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.
Demonstrative Examples 1
The following pseudocode illustrates the weak encryption resulting from the use of a pseudo-random-number generator output.

Code Example:

Bad
Pseudocode

If random_number_generator_self_test_passed() == TRUE then Seed = get_random_number_from_RNG() else Seed = hardcoded_number

In the example above, first a check of RNG ready is performed. If the check fails, the RNG is ignored and a hard coded value is used instead. The hard coded value severely weakens the encrypted output.

Code Example:

Good
Pseudocode

If random_number_generator_self_test_passed() == TRUE then Seed = get_random_number_from_RNG() else enter_error_state()

Applicable Platforms
Languages:
Verilog : UndeterminedVHDL : UndeterminedNot Language-Specific : Undetermined
Technologies:
Processor Hardware : UndeterminedNot Technology-Specific : Undetermined
Modes of Introduction
Architecture and Design
Implementation