← 返回首页
Use of a broken or weak cryptographic algorithm — CodeQL query help documentation CodeQL docs
CodeQL documentation
CodeQL resources

Use of a broken or weak cryptographic algorithm

ID: rust/weak-cryptographic-algorithm Kind: problem Security severity: 7.5 Severity: warning Precision: high Tags: - security - external/cwe/cwe-327 Query suites: - rust-code-scanning.qls - rust-security-extended.qls - rust-security-and-quality.qls

Click to see the query in the CodeQL repository

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:

Recommendation

Ensure that you use a strong, modern cryptographic algorithm, such as AES-128 or RSA-2048.

Example

The following code uses the des crate from the RustCrypto family to encrypt some secret data. The DES algorithm is old and considered very weak.

let des_cipher = cbc::Encryptor::<des::Des>::new(key.into(), iv.into()); // BAD: weak encryption let encryption_result = des_cipher.encrypt_padded_mut::<des::cipher::block_padding::Pkcs7>(data, data_len);

Instead, we should use a strong modern algorithm. In this case, we have selected the 256-bit version of the AES algorithm.

let aes_cipher = cbc::Encryptor::<aes::Aes256>::new(key.into(), iv.into()); // GOOD: strong encryption let encryption_result = aes_cipher.encrypt_padded_mut::<aes::cipher::block_padding::Pkcs7>(data, data_len);

References