CodeQL documentation
CodeQL resources

Use of a broken or weak cryptographic algorithm

ID: rust/weak-cryptographic-algorithm
Kind: problem
Security severity: 7.5
Severity: warning
Precision: high
Tags:
   - security
   - external/cwe/cwe-327
Query suites:
   - rust-code-scanning.qls
   - rust-security-extended.qls
   - rust-security-and-quality.qls

Click to see the query in the CodeQL repository

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:

  • If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.

  • If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users. This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash functions are handled by the rust/weak-sensitive-data-hashing query.

Recommendation

Ensure that you use a strong, modern cryptographic algorithm, such as AES-128 or RSA-2048.

Example

The following code uses the des crate from the RustCrypto family to encrypt some secret data. The DES algorithm is old and considered very weak.

let des_cipher = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // BAD: weak encryption
let encryption_result = des_cipher.encrypt_padded_mut::<des::cipher::block_padding::Pkcs7>(data, data_len);

Instead, we should use a strong modern algorithm. In this case, we have selected the 256-bit version of the AES algorithm.

let aes_cipher = cbc::Encryptor::<aes::Aes256>::new(key.into(), iv.into()); // GOOD: strong encryption
let encryption_result = aes_cipher.encrypt_padded_mut::<aes::cipher::block_padding::Pkcs7>(data, data_len);

References

  • © GitHub, Inc.
  • Terms
  • Privacy