Insecure encryption algorithm detected JAVA-S1012
DES encryption is insecure
51 StringBuffer sb = new StringBuffer();
52 HttpClient hc = HttpClient.newBuilder().build();
53 HttpRequest offerReq = HttpRequest.newBuilder(offerAPI).GET().build();
54 Cipher ci = Cipher.getInstance("DES/ECB/PKCS5Padding"); 55
56 HttpResponse<String> offerResp = hc.send(offerReq, HttpResponse.BodyHandlers.ofString());
57
Description
This code was found to be using an insecure encryption algorithm. This could allow malicious actors to easily break encryption on the application, leading to data breaches or even hijacking of infrastructure.
A number of encryption algorithms exist which are widely supported, but are also deprecated due to their lack of security. For example, the following algorithms are insecure and their usage is not recommended:
- DES
- Triple DES
- ARCFOUR/RC4
Bad Practice
Cipher c = Cipher.getInstance("DES/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);
Recommended
Make sure to use modern, currently accepted encryption algorithms for all security sensitive operations.
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);
References
- NIST - Latest publication on key management
- NIST - Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
- CWE-326 - Inadequate Encryption Strength
- OWASP Top Ten (2021) - Category A05 - Security Misconfiguration
- OWASP Top Ten (2021) - Category A02 - Cryptographic Failures