Java

JAVA.CRYPTO.RF : Risky Cryptographic Field (Java)

Summary

An unsafe cryptographic algorithm is used.

Some cryptography algorithms are nowadays considered as outdated and unsafe or actually broken, since they are too easy to decode. This checker identifies uses of unsafe algorithms for cryptography.

The OWASP documentation provides more information on Using the Java Cryptographic Extensions.

Properties

Class Name Risky Cryptographic Field (Java)
Significance security
Mnemonic JAVA.CRYPTO.RF
Categories
CWE CWE:327 Use of a Broken or Risky Cryptographic Algorithm
CERT-Java CERT-Java:DRD18 Do not use the default behavior in a cryptographic library if it does not use recommended practices
  CERT-Java:MSC02-J Generate strong random numbers
OWASP-2017 OWASP-2017:A2 Broken authentication
Availability Available for Java only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Risky Cryptographic Field (Java)"

Example 

import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;

public class BrokenAlgorithms {

  public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchPaddingException, NoSuchProviderException {
      Cipher.getInstance("DES");                   /* Warnings of two classes issued here:
                                                    * - Cryptographic Algorithm with Risky Default Cipher (Java)
                                                    * - Risky Cryptographic Algorithm (Java)
                                                    */
      Cipher.getInstance("MyComplexAlgo", "myProvider");
      Cipher.getInstance("MD5", "myProvider");     // Weak Hash Algorithm (Java) warning issued here

      String mypassword= "Hello World !";
      Base64.decodeBase64(mypassword.getBytes()); // Unsafe Base64 Encoding (Java) warning issued here

      Cipher.getInstance("AES/ECB/NoPadding");    // Cryptographic Algorithm with Weak Cipher (Java) warning issued here
      Cipher.getInstance("AES");                  // Cryptographic Algorithm with Risky Default Cipher (Java) warning issued here
  }
}

Resolution

Use a safer cryptography algorithm.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.