Skip to content

Commit 1f4bd00

Browse files
Jami Cogswelljcogs33
Jami Cogswell
authored and
jcogs33
committed
split rsa/dsa/dh
1 parent 25f0a13 commit 1f4bd00

File tree

4 files changed

+134
-42
lines changed

4 files changed

+134
-42
lines changed

‎java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll

Lines changed: 107 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -20,41 +20,121 @@ abstract class InsufficientKeySizeSink extends DataFlow::Node {
2020
private module Asymmetric {
2121
/** Provides models for non-elliptic-curve asymmetric cryptography. */
2222
private module NonEllipticCurve {
23-
/** A source for an insufficient key size used in RSA, DSA, and DH algorithms. */
24-
private class Source extends InsufficientKeySizeSource {
25-
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
23+
private module Rsa {
24+
/** A source for an insufficient key size used in an RSA algorithm. */
25+
private class Source extends InsufficientKeySizeSource {
26+
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
2627

27-
override predicate hasState(DataFlow::FlowState state) { state = getMinKeySize().toString() }
28+
override predicate hasState(DataFlow::FlowState state) {
29+
state = getMinKeySize().toString()
30+
}
31+
}
32+
33+
/** A sink for an insufficient key size used in an RSA algorithm. */
34+
private class Sink extends InsufficientKeySizeSink {
35+
Sink() {
36+
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
37+
kpg.getAlgoName() = "RSA" and
38+
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
39+
this.asExpr() = kpgInit.getKeySizeArg()
40+
)
41+
or
42+
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
43+
}
44+
45+
override predicate hasState(DataFlow::FlowState state) {
46+
state = getMinKeySize().toString()
47+
}
48+
}
49+
50+
/** Returns the minimum recommended key size for an RSA algorithm. */
51+
private int getMinKeySize() { result = minSecureKeySizeRsa() }
52+
53+
/** An instance of an RSA algorithm specification. */
54+
private class Spec extends ClassInstanceExpr {
55+
Spec() { this.getConstructedType() instanceof RsaKeyGenParameterSpec }
56+
57+
/** Gets the `keysize` argument of this instance. */
58+
Argument getKeySizeArg() { result = this.getArgument(0) }
59+
}
2860
}
2961

30-
/** A sink for an insufficient key size used in RSA, DSA, and DH algorithms. */
31-
private class Sink extends InsufficientKeySizeSink {
32-
Sink() {
33-
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
34-
kpg.getAlgoName().matches(["RSA", "DSA", "DH"]) and
35-
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
36-
this.asExpr() = kpgInit.getKeySizeArg()
37-
)
38-
or
39-
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
62+
private module Dsa {
63+
/** A source for an insufficient key size used a DSA algorithm. */
64+
private class Source extends InsufficientKeySizeSource {
65+
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
66+
67+
override predicate hasState(DataFlow::FlowState state) {
68+
state = getMinKeySize().toString()
69+
}
4070
}
4171

42-
override predicate hasState(DataFlow::FlowState state) { state = getMinKeySize().toString() }
72+
/** A sink for an insufficient key size used in a DSA algorithm. */
73+
private class Sink extends InsufficientKeySizeSink {
74+
Sink() {
75+
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
76+
kpg.getAlgoName() = "DSA" and
77+
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
78+
this.asExpr() = kpgInit.getKeySizeArg()
79+
)
80+
or
81+
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
82+
}
83+
84+
override predicate hasState(DataFlow::FlowState state) {
85+
state = getMinKeySize().toString()
86+
}
87+
}
88+
89+
/** Returns the minimum recommended key size for a DSA algorithm. */
90+
private int getMinKeySize() { result = minSecureKeySizeDsa() }
91+
92+
/** An instance of a DSA algorithm specification. */
93+
private class Spec extends ClassInstanceExpr {
94+
Spec() { this.getConstructedType() instanceof DsaGenParameterSpec }
95+
96+
/** Gets the `keysize` argument of this instance. */
97+
Argument getKeySizeArg() { result = this.getArgument(0) }
98+
}
4399
}
44100

45-
/** Returns the minimum recommended key size for RSA, DSA, and DH algorithms. */
46-
private int getMinKeySize() { result = minSecureKeySizeAsymmetricNonEc() }
101+
private module Dh {
102+
/** A source for an insufficient key size used in a DH algorithm. */
103+
private class Source extends InsufficientKeySizeSource {
104+
Source() { this.asExpr().(IntegerLiteral).getIntValue() < getMinKeySize() }
47105

48-
/** An instance of an RSA, DSA, or DH algorithm specification. */
49-
private class Spec extends ClassInstanceExpr {
50-
Spec() {
51-
this.getConstructedType() instanceof RsaKeyGenParameterSpec or
52-
this.getConstructedType() instanceof DsaGenParameterSpec or
53-
this.getConstructedType() instanceof DhGenParameterSpec
106+
override predicate hasState(DataFlow::FlowState state) {
107+
state = getMinKeySize().toString()
108+
}
54109
}
55110

56-
/** Gets the `keysize` argument of this instance. */
57-
Argument getKeySizeArg() { result = this.getArgument(0) }
111+
/** A sink for an insufficient key size used in a DH algorithm. */
112+
private class Sink extends InsufficientKeySizeSink {
113+
Sink() {
114+
exists(KeyPairGenInit kpgInit, KeyPairGen kpg |
115+
kpg.getAlgoName() = "DH" and
116+
DataFlow::localExprFlow(kpg, kpgInit.getQualifier()) and
117+
this.asExpr() = kpgInit.getKeySizeArg()
118+
)
119+
or
120+
exists(Spec spec | this.asExpr() = spec.getKeySizeArg())
121+
}
122+
123+
override predicate hasState(DataFlow::FlowState state) {
124+
state = getMinKeySize().toString()
125+
}
126+
}
127+
128+
/** Returns the minimum recommended key size for a DH algorithm. */
129+
private int getMinKeySize() { result = minSecureKeySizeDh() }
130+
131+
/** An instance of an RSA, DSA, or DH algorithm specification. */
132+
private class Spec extends ClassInstanceExpr {
133+
Spec() { this.getConstructedType() instanceof DhGenParameterSpec }
134+
135+
/** Gets the `keysize` argument of this instance. */
136+
Argument getKeySizeArg() { result = this.getArgument(0) }
137+
}
58138
}
59139
}
60140

@@ -88,7 +168,7 @@ private module Asymmetric {
88168
}
89169

90170
/** Returns the minimum recommended key size for elliptic curve (EC) algorithms. */
91-
private int getMinKeySize() { result = minSecureKeySizeAsymmetricEc() }
171+
private int getMinKeySize() { result = minSecureKeySizeEcc() }
92172

93173
/** Returns the key size from an EC algorithm's curve name string */
94174
bindingset[algorithm]
@@ -169,7 +249,7 @@ private module Symmetric {
169249
}
170250

171251
/** Returns the minimum recommended key size for AES algorithms. */
172-
private int getMinKeySize() { result = minSecureKeySizeSymmetric() }
252+
private int getMinKeySize() { result = minSecureKeySizeAes() }
173253

174254
/** A call to the `init` method declared in `javax.crypto.KeyGenerator`. */
175255
private class KeyGenInit extends MethodAccess {

‎java/ql/lib/semmle/code/java/security/internal/EncryptionKeySizes.qll

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,17 @@
55
* Such that we can share this logic across our CodeQL analysis of different languages.
66
*/
77

8-
/** Returns the minimum recommended key size for asymmetric algorithms (RSA, DSA, and DH). */
9-
int minSecureKeySizeAsymmetricNonEc() { result = 2048 }
8+
/** Returns the minimum recommended key size for RSA. */
9+
int minSecureKeySizeRsa() { result = 2048 }
1010

11-
/** Returns the minimum recommended key size for elliptic curve (EC) algorithms. */
12-
int minSecureKeySizeAsymmetricEc() { result = 256 }
11+
/** Returns the minimum recommended key size for DSA. */
12+
int minSecureKeySizeDsa() { result = 2048 }
1313

14-
/** Returns the minimum recommended key size for symmetric algorithmms (AES). */
15-
int minSecureKeySizeSymmetric() { result = 128 }
14+
/** Returns the minimum recommended key size for DH. */
15+
int minSecureKeySizeDh() { result = 2048 }
16+
17+
/** Returns the minimum recommended key size for elliptic curve cryptography. */
18+
int minSecureKeySizeEcc() { result = 256 }
19+
20+
/** Returns the minimum recommended key size for AES. */
21+
int minSecureKeySizeAes() { result = 128 }

‎python/ql/lib/semmle/python/Concepts.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1142,21 +1142,21 @@ module Cryptography {
11421142
abstract class RsaRange extends Range {
11431143
final override string getName() { result = "RSA" }
11441144

1145-
final override int minimumSecureKeySize() { result = minSecureKeySizeAsymmetricNonEc() }
1145+
final override int minimumSecureKeySize() { result = minSecureKeySizeRsa() }
11461146
}
11471147

11481148
/** A data-flow node that generates a new DSA key-pair. */
11491149
abstract class DsaRange extends Range {
11501150
final override string getName() { result = "DSA" }
11511151

1152-
final override int minimumSecureKeySize() { result = minSecureKeySizeAsymmetricNonEc() }
1152+
final override int minimumSecureKeySize() { result = minSecureKeySizeDsa() }
11531153
}
11541154

11551155
/** A data-flow node that generates a new ECC key-pair. */
11561156
abstract class EccRange extends Range {
11571157
final override string getName() { result = "ECC" }
11581158

1159-
final override int minimumSecureKeySize() { result = minSecureKeySizeAsymmetricEc() }
1159+
final override int minimumSecureKeySize() { result = minSecureKeySizeEcc() }
11601160
}
11611161
}
11621162
}

‎python/ql/lib/semmle/python/security/internal/EncryptionKeySizes.qll

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,17 @@
55
* Such that we can share this logic across our CodeQL analysis of different languages.
66
*/
77

8-
/** Returns the minimum recommended key size for asymmetric algorithms (RSA, DSA, and DH). */
9-
int minSecureKeySizeAsymmetricNonEc() { result = 2048 }
8+
/** Returns the minimum recommended key size for RSA. */
9+
int minSecureKeySizeRsa() { result = 2048 }
1010

11-
/** Returns the minimum recommended key size for elliptic curve (EC) algorithms. */
12-
int minSecureKeySizeAsymmetricEc() { result = 256 }
11+
/** Returns the minimum recommended key size for DSA. */
12+
int minSecureKeySizeDsa() { result = 2048 }
1313

14-
/** Returns the minimum recommended key size for symmetric algorithmms (AES). */
15-
int minSecureKeySizeSymmetric() { result = 128 }
14+
/** Returns the minimum recommended key size for DH. */
15+
int minSecureKeySizeDh() { result = 2048 }
16+
17+
/** Returns the minimum recommended key size for elliptic curve cryptography. */
18+
int minSecureKeySizeEcc() { result = 256 }
19+
20+
/** Returns the minimum recommended key size for AES. */
21+
int minSecureKeySizeAes() { result = 128 }

0 commit comments

Comments
 (0)