A municipal payment portal uses a well-regarded cipher suite, yet testers recover plaintext via a padding-oracle style flaw and weak random number generation for nonces. Where should remediation focus?
Select an answer to reveal the explanation.
Short Explanation
A great lock on a crooked door still fails. Padding oracles and bad RNG are implementation wounds, not proof the algorithm name was wrong. Fix how crypto is built and seeded, not the brochure.
Full Explanation
Implementation attacks succeed when correct algorithms are used incorrectly—examples include padding-oracle vulnerabilities, nonce reuse, and weak pseudorandom generators. Secure engineering therefore emphasizes vetted libraries, protocol correctness, constant-time where required, and CSPRNG quality. Choosing a strong algorithm name does not compensate for flawed implementation.