RRath560205 (Community Member) asked a question.
How to fix CWE ID 327 Use of a Broken or Risky Cryptographic Algorithm
Veracode site suggested that to fix CWE ID-327, use AES instead of DES, We have done the changes but still flaw not resolved.
Code:
if ( xForm == null && ivSpec == null )
// xForm = "DES";
xForm = "AES";
else if ( xForm == null )
//xForm = "DES/CBC/PKCS5Padding";
xForm = "AES/CBC/PKCS5Padding";
ecipher = Cipher.getInstance(xForm);
Kindly suggest what changes can be done to resolve this flaw.
.png){kind=logo}
Hi @RRath560205 (Community Member) ,
I would highly recommend reading the excellent blog articles from Mansi Sheth (@Mansi_Sh (Community Member) ): https://www.veracode.com/blog/research/encryption-and-decryption-java-cryptography
Here she says very explicitly:
Basically, never, ever do something like:
// ANTI-PATTERN
// This defaults to using ECB mode of operation, which should never be used for any cryptographic operations. Plaintext blocks generates
// identical cipher text blocks.
Cipher c = Cipher.getInstance("AES");
If you remove this from the original code you will see that Veracode Static Analysis stops reporting the flaw.
I would recommend choosing a recommended option from the blog post by Mansi.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema