CWE-322 (未进行实体认证的密钥交换) — Vulnerability Class 20

CWE-322 represents a critical cryptographic weakness where a system establishes an encrypted key exchange without verifying the identity of the participating entities. This flaw allows attackers to execute man-in-the-middle attacks by intercepting and modifying traffic between two parties, effectively impersonating one or both actors. Although the resulting communication channel remains encrypted and intact, the lack of authentication means the parties cannot trust the source of the data. Developers mitigate this vulnerability by implementing robust mutual authentication protocols, such as requiring digital certificates or pre-shared keys before initiating key exchange. By ensuring that both sides verify each other’s identities through trusted third parties or cryptographic signatures, organizations can prevent unauthorized interception and maintain the true integrity of the communication session.