V3: Cryptography Requirements

Control Objective

Cryptography is an essential ingredient when it comes to protecting data stored on a mobile device. It is also a category where things can go horribly wrong, especially when standard conventions are not followed. The purpose of the controls in this chapter is to ensure that the verified application uses cryptography according to industry best practices, including:

  • Use of proven cryptographic libraries;

  • Proper choice and configuration of cryptographic primitives;

  • A suitable random number generator wherever randomness is required.

Security Verification Requirements


The OWASP Mobile Security Testing Guide provides detailed instructions for verifying the requirements listed in this section.

For more information, see also:

Last updated