Update Cryptographic Language (e.g. "weak")

[sydseter]

This PR contains:

• Addition concerning Symmetric encryption
• Additional advice on forward compliance with NIST
• Additional recommendation on the use of EdDSA with Edwards448
• Post-Quantum recommendations
• Additional recommendations concerning the use of a key-derivation key.
• CSPRNG alignment with ASVS.
• Additional recommendation when using CBC with MAC.
• Attack related to CBC-MAC
• Removing the use of the word “weak”. Instead focusing on recommendations and advice.
• Adding appropriate description, impact, modes of introduction and mitigations to MASWE-0010, MASWE-0021, MASWE-0024 and MASWE-0025.

This PR closes #3200.

[sydseter]

@cpholguera What do you do with external links that return HTTP status 403 or 0, but that can be reached by human browsing?

[sydseter]

I am leaving the internal links as they are. It's ok to use the word "weak" as a general term when talking about a category of issues. My reaction and corrections is meant to make it more specific as to what we are talking about when we are referring to cryptographic concepts. A padding scheme can be predictable, the bit-size of an algorithm insufficient, input validation and crypto configuration, inappropriate or improper and so on.
I think it is better to rename the links as more MASWE gets defined. As I see it now, it isn't very problematic to leave it as it is.

[sydseter]

There is something not working with the MASTG-DEMO tests. The moment I started touching them, the matrix broke. So I am leaving them aside.

[cpholguera]

@cpholguera What do you do with external links that return HTTP status 403 or 0, but that can be reached by human browsing?

Is this about the GitHub action failing? You can add them to https://github.com/OWASP/owasp-mastg/blob/master/.github/workflows/config/url-checker-config.json

[cpholguera]

There is something not working with the MASTG-DEMO tests. The moment I started touching them, the matrix broke. So I am leaving them aside.

I just fixed the matrix. If you git pull origin master it should be fine again. Thanks for letting me know!

[cpholguera]

Just a quick first pass for now, thanks a lot @sydseter!

[cpholguera]

Idea: maybe we could also build a glossary for these and other terms.

See:

• https://cwe.mitre.org/documents/glossary/index.html#Insufficient
• https://csrc.nist.gov/glossary

[sydseter]

Idea: maybe we could also build a glossary for these and other terms.

See:

• https://cwe.mitre.org/documents/glossary/index.html#Insufficient
• https://csrc.nist.gov/glossary

Done.

[sydseter]

There is something not working with the MASTG-DEMO tests. The moment I started touching them, the matrix broke. So I am leaving them aside.

I just fixed the matrix. If you git pull origin master it should be fine again. Thanks for letting me know!

Updated MASTG-DEMO tests.