This code was found to be using an insecure encryption algorithm. This could allow malicious actors to easily break encryption on the application, leading to data breaches or even hijacking of infrastructure.

A number of encryption algorithms exist which are widely supported, but are also deprecated due to their lack of security. For example, the following algorithms are insecure and their usage is not recommended:

DES
Triple DES
ARCFOUR/RC4

Bad Practice

Cipher c = Cipher.getInstance("DES/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

Recommended

Make sure to use modern, currently accepted encryption algorithms for all security sensitive operations.

Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

References

NIST - Latest publication on key management
NIST - Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
CWE-326 - Inadequate Encryption Strength
OWASP Top Ten (2021) - Category A05 - Security Misconfiguration
OWASP Top Ten (2021) - Category A02 - Cryptographic Failures

QuackatronHQ / Gigarepo

No ignore rules found