Crypto: Add Java Cryptographic Analysis Queries#20605

Draft

bdrodes wants to merge 31 commits intogithub:mainfrom

bdrodes:santander-java-crypto-check

Commits on Oct 1, 2025

Commits on Oct 8, 2025

Merge remote-tracking branch 'upstream/java-crypto-check' into santander-java-crypto-check
bdrodes
committed
Crypto: Standardize naming where use of "family" and "type" have been used. Prefer 'type'.
bdrodes
committed
Crypto: Modify suggested queries per misc. side conversations on standards. Remove redundant query. Fix QL-for-QL issues.
bdrodes
committed
Crypto: Remove redundant queries.
bdrodes
committed
Crypto: Removing JCA model of random, need to reassess this as this impacts the insecure IV/Nonce query. Updated name of the Insecure nonce query to be InsecureIVorNonce
bdrodes
committed
Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.
bdrodes
committed
Crypto: Adding query for unknown IV initialization.
bdrodes
committed
Crypto: Update general regression test results to account for removal of JCA random source.
bdrodes
committed
Crypto: Updated default flows to use taint tracking (this is needed to fix false positives in the unknown IV/Nonce query). Add the unknown IV/Nonce query and associated test cases. Fix unknown IV/N…
bdrodes
committed
Crypto: Missing test update.
bdrodes
committed
Crypto: Updating insecure iv/nonce to consider if an operation is known for it, and if so do not alert on non-secure random if it is tied to decryption
bdrodes
committed

Commits on Oct 13, 2025