What Is Broken Cryptography? Definition & Examples

Broken cryptography is the use of weak, outdated, misconfigured, or incorrectly implemented encryption that no longer protects data or identities as intended. In security operations, it can expose secrets, sessions, and communications because the algorithm, key management, randomness, or protocol handling fails to provide reliable confidentiality, integrity, or authentication.

What Broken Cryptography Means

Broken cryptography is not just “weak encryption,” it is cryptography that fails in practice because the design, implementation, configuration, or key handling no longer provides the protection the system assumes. That failure can turn encryption into a false sense of safety.

In modern environments, the damage usually comes from one of four places: the algorithm is obsolete, the implementation is flawed, the key lifecycle is unsafe, or the protocol is used incorrectly. Any one of those can leave data readable, tamperable, or impersonable even when encryption appears to be enabled.

Why Broken Cryptography Is Dangerous

The danger is that broken cryptography can fail silently. Data may still move through encrypted channels, but attackers may be able to recover secrets, hijack sessions, alter messages, or impersonate trusted systems because the underlying protection no longer holds.

This is especially serious for credentials, API keys, session tokens, certificates, and other identity-bearing material. When cryptography fails around those assets, the result is often not just data exposure but direct access to systems and services that were meant to stay trusted.

Encryption also depends on randomness, initialization, padding, signing, and verification behaving correctly. A weakness in any of those areas can undermine confidentiality, integrity, or authentication even when the cryptographic primitive itself is theoretically sound.

Common Failure Modes and Implementation Patterns

Broken cryptography often appears as outdated algorithms, weak modes of operation, hard-coded secrets, poor certificate handling, reused nonces or initialization vectors, predictable randomness, or custom cryptographic code that was never validated by specialists. Misuse of “secure” libraries can be just as risky as writing cryptography from scratch.

Key management is another frequent failure point. Keys that are too long-lived, poorly stored, shared too broadly, or not rotated after exposure can make every protected asset dependent on a single compromised secret. That is why key lifecycle discipline matters as much as algorithm choice.

Protocol mistakes are also common, especially when systems accept weak ciphers, skip certificate validation, allow downgrade paths, or mix encryption with missing integrity checks. Those issues can make attackers able to intercept or modify traffic without immediately breaking the connection.

How Organisations Reduce Exposure

Organisations reduce exposure by inventorying where cryptography is used, identifying which algorithms, protocols, and keys protect which assets, and checking whether those controls still meet current security expectations. This includes certificates, session handling, secure transport, secrets storage, and any custom encryption logic.

For key lifecycle and algorithm selection, NIST SP 800-57 Key Management is the most directly useful reference because it focuses on cryptographic key lifecycle, cryptoperiods, and appropriate key handling. For broader cryptographic and control governance, ISO/IEC 27001:2022 Information Security Management provides a control-oriented way to govern cryptography, access, and secure configuration across the organisation.

Where cryptography protects APIs or service-to-service traffic, teams should also verify that authentication and authorization do not rely on weak token handling or broken object access assumptions. The OWASP API Security Top 10 is useful when the cryptographic weakness sits inside an API trust boundary rather than a standalone encryption layer.

Risk and Threat Considerations

Broken cryptography creates a high-value attack path because attackers do not need to defeat the entire system, only the weak point in its protection model. Once encryption, signing, or session protection fails, confidentiality and trust can collapse quickly across multiple dependent systems.

Failure mechanism: Weak algorithms, flawed implementations, poor randomness, or bad key handling allow attackers to decrypt data, forge messages, replay sessions, or impersonate trusted parties.

Impact: Secrets, communications, and identities can be exposed or abused, which can lead to account takeover, unauthorized access, data tampering, and broad lateral movement if the same cryptographic material is reused across services.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack surface, NIST SP 800-57 sets the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-57	Key Management	Broken cryptography often fails through weak key lifecycle and algorithm selection.
Recommendation — Apply NIST SP 800-57 to govern key generation, storage, rotation, and retirement.
ISO/IEC 27001:2022	A.8.24 — Use of cryptography	This term is directly about cryptographic protection failing through weak or misused encryption.
Recommendation — Enforce A.8.24 to define and control approved cryptographic use across systems.
OWASP API Security Top 10	API2 — Broken Authentication	Broken cryptography often undermines API tokens, sessions, and trust in authentication flows.
Recommendation — Harden API authentication flows so token and session protection cannot be bypassed.

Broken Cryptography