JAVA.CRYPTO.CAWH : Cryptographic Algorithm with Weak Hash (Java)

A cryptographic algorithm that contains a possibly reversible hashing algorithm.

Some cryptography algorithms are nowadays considered as outdated and unsafe or actually broken, since they are too easy to decode. This checker identifies uses of unsafe algorithms for cryptography.

プロパティ

クラス名

Cryptographic Algorithm with Weak Hash (Java)

日本語クラス名

Cryptographic Algorithm with Weak Hash (Java)

クラス分類

セキュリティ (security)

ニーモニック

JAVA.CRYPTO.CAWH

カテゴリー

CWE	CWE:328	Use of Weak Hash
CERT-Java	CERT-Java:DRD18	Do not use the default behavior in a cryptographic library if it does not use recommended practices
OWASP-2017	OWASP-2017:A2	Broken authentication
OWASP-2021	OWASP-2021:A7	Identification and authorization failures

対応言語

Java で利用可能です。

有効/無効設定

このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル（configuration file）に以下の WARNING_FILTER ルールを追加してください。

WARNING_FILTER += discard class="Cryptographic Algorithm with Weak Hash (Java)"

例

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.Signature;
import java.security.SignatureException;
import java.util.Arrays;

public class Signature {
    
  public static String getSignature(String text) { 

      String ret = null;

      try { 
        KeyPair keyPair = getKeyPair(); 
        byte[] data = text.getBytes("UTF8"); 
        Signature signature = Signature.getInstance("SHA1withRSA"); // "Cryptographic Algorithm with Weak Hash (Java)" warning issued here
        signature.initSign(keyPair.getPrivate()); 
        signature.update(data); 
        byte[] bytes = signature.sign(); 
        ret = Arrays.toString(bytes); 
      } catch (UnsupportedEncodingException | NoSuchAlgorithmException
               | InvalidKeyException | SignatureException e) { 
        System.out.println("Unable to compute the signature: " + e); 
      }
      return ret;
  } 

  private static KeyPair getKeyPair() throws NoSuchAlgorithmException 
      { 
      KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA"); 
      generator.initialize(1024); 
      return generator.genKeyPair(); 
  } 
}

In this example, the analysis triggers a Cryptographic Algorithm with Weak Hash (Java) warning because RSA (a safe cryptographic algorithm) is used in combination with SHA-1 (an unsafe hashing algorithm) to generate a signature. The OWASP documentation provides more information on Testing for Weak Encryption.

To resolve this issue, change the hashing algorithm to a more secure one. For example, replace string "SHA1withRSA" with "SHA256withRSA" in the call to Signature.getInstance().

解決法

Use a safer cryptography algorithm.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。