AWS logo
Amazon QDetector Library

Insecure Cryptography Critical

Misuse of cryptography-related APIs can create security vulnerabilities. This includes one or more of the following: algorithms with known weaknesses, certain padding modes, lack of integrity checks, and insufficiently large key sizes.

Detector ID
csharp/insecure-cryptography@v1.0
Category
Common Weakness Enumeration (CWE) external icon
Tags
-

Noncompliant example

1public void InsecureCryptographyNoncompliant()
2{
3    Aes aeskey = Aes.Create();
4    // Noncompliant: `ECB` is insecure encryption mode.
5    aeskey.Mode = CipherMode.ECB;
6    using var encryptor = aeskey.CreateEncryptor();
7    byte[] msg = new byte[32];
8    var cipherText = encryptor.TransformFinalBlock(msg, 0, msg.Length);
9}

Compliant example

1public void InsecureCryptographyCompliant()
2{
3    // Compliant: AES-GCM provides authenticated encryption.
4    byte[] key = new byte[32];
5    RandomNumberGenerator.Fill(key);
6    byte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];
7    RandomNumberGenerator.Fill(nonce);
8    byte[] msg = new byte[32];
9    byte[] cipherText = new byte[msg.Length];
10    byte[] tag = new byte[AesGcm.TagByteSizes.MaxSize];
11    using var aesGcm = new AesGcm(key, AesGcm.TagByteSizes.MaxSize);
12    aesGcm.Encrypt(nonce, msg, cipherText, tag);
13}