CWE-325, Missing Cryptographic Step, means a product omits a step that a cryptographic algorithm requires. The result is weaker protection than the algorithm promises on paper.
It most often appears in hand written protocol or cipher implementations, and in code that copies part of a scheme and leaves the rest out.
How it happens
Cryptographic algorithms are specified as exact sequences. Remove one step, such as a challenge in an authentication exchange, and the guarantees built on that step vanish, even though the code still looks like it uses strong cryptography.
The observed example is CVE-2001-1585: a missing challenge-response step allowed authentication bypass using a public key.
What an attacker gains
MITRE lists bypassing a protection mechanism, reading and modifying application data, and hiding activities, which touches accountability and non-repudiation.
How to find it
Static analysis can find some instances. Review of custom crypto against the written specification is the stronger check, ideally by someone who did not write it.
How to fix it
Do not write your own implementation of a standard algorithm. Use a well tested library that performs every step, and keep it updated. Where a protocol needs a challenge or similar exchange, follow the specification exactly.
Quick check
Why can this look secure in testing?
Because the data still comes out scrambled. The missing step only matters to an attacker who knows to exploit it.
