JAVA.CRYPTO.CAWH : Cryptographic Algorithm with Weak Hash (Java)

A cryptographic algorithm that contains a possibly reversible hashing algorithm.

Some cryptography algorithms are nowadays considered as outdated and unsafe or actually broken, since they are too easy to decode. This checker identifies uses of unsafe algorithms for cryptography.

Properties

Example

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.Signature;
import java.security.SignatureException;
import java.util.Arrays;

public class Signature {
    
  public static String getSignature(String text) { 

      String ret = null;

      try { 
        KeyPair keyPair = getKeyPair(); 
        byte[] data = text.getBytes("UTF8"); 
        Signature signature = Signature.getInstance("SHA1withRSA"); // "Cryptographic Algorithm with Weak Hash (Java)" warning issued here
        signature.initSign(keyPair.getPrivate()); 
        signature.update(data); 
        byte[] bytes = signature.sign(); 
        ret = Arrays.toString(bytes); 
      } catch (UnsupportedEncodingException | NoSuchAlgorithmException
               | InvalidKeyException | SignatureException e) { 
        System.out.println("Unable to compute the signature: " + e); 
      }
      return ret;
  } 

  private static KeyPair getKeyPair() throws NoSuchAlgorithmException 
      { 
      KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA"); 
      generator.initialize(1024); 
      return generator.genKeyPair(); 
  } 
}

In this example, the analysis triggers a Cryptographic Algorithm with Weak Hash (Java) warning because RSA (a safe cryptographic algorithm) is used in combination with SHA-1 (an unsafe hashing algorithm) to generate a signature. The OWASP documentation provides more information on Testing for Weak Encryption.

To resolve this issue, change the hashing algorithm to a more secure one. For example, replace string "SHA1withRSA" with "SHA256withRSA" in the call to Signature.getInstance().

Resolution

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.