HSingh424927 (Community Member) asked a question.
I am getting "CWE 327 Use of a Broken or Risky Cryptographic Algorithm" while invoking
PBEKeySpec(char[] password, byte[] salt, int iterationCount, int keyLength) in my code.
PBEKeySpec(char[] password, byte[] salt, int iterationCount, int keyLength) in my code.
Some of the solutions that I found suggest to user the keyLength as 256 which I am already providing. What else can be done to remediate this?
.png){kind=logo}
Hi @HSingh424927 (Community Member), Veracode static analysis can report CWE 327 for multiple reasons and so I always recommend checking the flaw details section that contains the detailed description and remediation advice which should point towards the cause more succinctly. This video from our help documentation shows how to find this section: https://www.youtube.com/watch?v=WTF53s02nG8&t=123s.
Besides key length, static analysis could also be reporting use of a hard-coded salt, which should be instead random from a SecureRandom source and >=8 bytes. Static analysis could also be reporting the iteration count which we currently recommend at >=100,000.
You can find a lot of good information about our current cryptography recommendations in these blog posts: https://www.veracode.com/blog/research/encryption-and-decryption-java-cryptography and https://www.veracode.com/blog/research/password-storage-using-java