Java

JAVA.CRYPTO.MRCS : Missing Required Cryptographic Step (Java)

Summary

A function uses a cryptographic operation, but is missing a prerequisite step for that operation.

Properties

Class Name Missing Required Cryptographic Step (Java)
Significance security
Mnemonic JAVA.CRYPTO.MRCS
Categories
CWE CWE:325 Missing Cryptographic Step
Availability Available for Java only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Missing Required Cryptographic Step (Java)"

Example 

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
public class MissingCryptoStep {

    public void CryptoMethod() throws NoSuchAlgorithmException {
        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
        SecretKey secretKey = keyGenerator.generateKey(); // 'Missing Required Cryptographic Step (Java)' warning issued here:
                                      // - Missing call to init() before call to generateKey().
                                      // - Default initialization will be used. This may result in a less secure key than desired,
                                      //   and may also cause interoperability issues if multiple different cryptographic
                                      //   providers are used.
        // ...
        MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");
        byte[] hash = messageDigest.digest(); // 'Missing Required Cryptographic Step (Java)' warning issued here:
                                      // - Missing call to update() before call to digest().
                                      // - 'hash' will contain no data.
        // ...
    }
}

Resolution

Add the missing cryptographic step.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.