Skip to content

Commit 2714c7f

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
update tests
1 parent da218fd commit 2714c7f

File tree

2 files changed

+107
-159
lines changed

2 files changed

+107
-159
lines changed

‎java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.java

Lines changed: 106 additions & 153 deletions
Original file line numberDiff line numberDiff line change
@@ -10,244 +10,197 @@
1010
public class InsufficientKeySizeTest {
1111
public void keySizeTesting() throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
1212

13-
// Test basic key generation for all algos
14-
15-
// AES (Symmetric)
13+
/* AES (Symmetric): minimum recommended key size is 128 */
1614
{
17-
// BAD: Key size is less than 128
15+
/* Test with keysize as int */
1816
KeyGenerator keyGen1 = KeyGenerator.getInstance("AES");
1917
keyGen1.init(64); // $ hasInsufficientKeySize
2018

21-
// GOOD: Key size is no less than 128
2219
KeyGenerator keyGen2 = KeyGenerator.getInstance("AES");
23-
keyGen2.init(128); // Safe
20+
keyGen2.init(128); // Safe: Key size is no less than 128
21+
22+
/* Test with local variable as keysize */
23+
final int size1 = 64; // compile-time constant
24+
int size2 = 64; // not a compile-time constant
25+
26+
KeyGenerator keyGen3 = KeyGenerator.getInstance("AES");
27+
keyGen3.init(size1); // $ hasInsufficientKeySize
28+
29+
KeyGenerator keyGen4 = KeyGenerator.getInstance("AES");
30+
keyGen4.init(size2); // $ hasInsufficientKeySize
31+
32+
/* Test variables passed to another method */
33+
KeyGenerator keyGen = KeyGenerator.getInstance("AES"); // MISSING: test KeyGenerator variable as argument
34+
testSymmetricVariable(size2, keyGen); // test with variable as key size
35+
testSymmetricInt(64); // test with int literal as key size
2436
}
2537

26-
// RSA (Asymmetric)
38+
// RSA (Asymmetric): minimum recommended key size is 2048
2739
{
28-
// BAD: Key size is less than 2048
40+
/* Test with keysize as int */
2941
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("RSA");
3042
keyPairGen1.initialize(1024); // $ hasInsufficientKeySize
3143

32-
// GOOD: Key size is no less than 2048
3344
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("RSA");
34-
keyPairGen2.initialize(2048); // Safe
45+
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
3546

36-
// test with spec
37-
// BAD: Key size is less than 2048
3847
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("RSA");
3948
RSAKeyGenParameterSpec rsaSpec = new RSAKeyGenParameterSpec(1024, null); // $ hasInsufficientKeySize
4049
keyPairGen3.initialize(rsaSpec);
4150

42-
// BAD: Key size is less than 2048
4351
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("RSA");
4452
keyPairGen4.initialize(new RSAKeyGenParameterSpec(1024, null)); // $ hasInsufficientKeySize
53+
54+
/* Test with local variable as keysize */
55+
final int size1 = 1024; // compile-time constant
56+
int size2 = 1024; // not a compile-time constant
57+
58+
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("RSA");
59+
keyPairGen5.initialize(size1); // $ hasInsufficientKeySize
60+
61+
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("RSA");
62+
keyPairGen6.initialize(size2); // $ hasInsufficientKeySize
63+
64+
/* Test variables passed to another method */
65+
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA"); // MISSING: test KeyGenerator variable as argument
66+
testAsymmetricNonEcVariable(size2, keyPairGen); // test with variable as key size
67+
testAsymmetricNonEcInt(1024); // test with int literal as key size
4568
}
4669

47-
// DSA (Asymmetric)
70+
// DSA (Asymmetric): minimum recommended key size is 2048
4871
{
49-
// BAD: Key size is less than 2048
50-
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DSA");
51-
keyPairGen3.initialize(1024); // $ hasInsufficientKeySize
72+
/* Test with keysize as int */
73+
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("DSA");
74+
keyPairGen1.initialize(1024); // $ hasInsufficientKeySize
5275

53-
// GOOD: Key size is no less than 2048
54-
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("DSA");
55-
keyPairGen4.initialize(2048); // Safe
76+
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
77+
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
5678

57-
// test with spec
58-
// BAD: Key size is less than 2048
59-
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("DSA");
79+
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DSA");
6080
DSAGenParameterSpec dsaSpec = new DSAGenParameterSpec(1024, 0); // $ hasInsufficientKeySize
61-
keyPairGen5.initialize(dsaSpec);
81+
keyPairGen3.initialize(dsaSpec);
6282

63-
// BAD: Key size is less than 2048
64-
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("DSA");
65-
keyPairGen6.initialize(new DSAGenParameterSpec(1024, 0)); // $ hasInsufficientKeySize
83+
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("DSA");
84+
keyPairGen4.initialize(new DSAGenParameterSpec(1024, 0)); // $ hasInsufficientKeySize
6685
}
6786

68-
// DH (Asymmetric)
87+
// DH (Asymmetric): minimum recommended key size is 2048
6988
{
70-
// BAD: Key size is less than 2048
71-
KeyPairGenerator keyPairGen16 = KeyPairGenerator.getInstance("dh");
72-
keyPairGen16.initialize(1024); // $ hasInsufficientKeySize
89+
/* Test with keysize as int */
90+
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("dh");
91+
keyPairGen1.initialize(1024); // $ hasInsufficientKeySize
7392

74-
// GOOD: Key size is no less than 2048
75-
KeyPairGenerator keyPairGen17 = KeyPairGenerator.getInstance("DH");
76-
keyPairGen17.initialize(2048); // Safe
93+
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DH");
94+
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
7795

78-
// test with spec
79-
// BAD: Key size is less than 2048
8096
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
8197
DHGenParameterSpec dhSpec = new DHGenParameterSpec(1024, 0); // $ hasInsufficientKeySize
8298
keyPairGen3.initialize(dhSpec);
8399

84-
// BAD: Key size is less than 2048
85100
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("DH");
86101
keyPairGen4.initialize(new DHGenParameterSpec(1024, 0)); // $ hasInsufficientKeySize
87102
}
88103

89-
// EC (Asymmetric)
90-
// ! Check if I can re-use the same KeyPairGenerator instance with all of the below?
104+
// EC (Asymmetric): minimum recommended key size is 256
91105
{
92-
// BAD: Key size is less than 256
93-
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("EC");
106+
/* Test with keysize as int */
107+
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("EC");
108+
keyPairGen1.initialize(128); // $ hasInsufficientKeySize
109+
110+
/* Test with keysize as curve name in spec */
111+
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("EC");
94112
ECGenParameterSpec ecSpec1 = new ECGenParameterSpec("secp112r1"); // $ hasInsufficientKeySize
95-
keyPairGen5.initialize(ecSpec1);
113+
keyPairGen2.initialize(ecSpec1);
96114

97-
// BAD: Key size is less than 256
98-
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("EC");
99-
keyPairGen6.initialize(new ECGenParameterSpec("secp112r1")); // $ hasInsufficientKeySize
115+
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("EC");
116+
keyPairGen3.initialize(new ECGenParameterSpec("secp112r1")); // $ hasInsufficientKeySize
100117

101-
// GOOD: Key size is no less than 256
102-
KeyPairGenerator keyPairGen7 = KeyPairGenerator.getInstance("EC");
103-
ECGenParameterSpec ecSpec2 = new ECGenParameterSpec("secp256r1");
104-
keyPairGen7.initialize(ecSpec2); // Safe
118+
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("EC");
119+
ECGenParameterSpec ecSpec2 = new ECGenParameterSpec("secp256r1"); // Safe: Key size is no less than 256
120+
keyPairGen4.initialize(ecSpec2);
105121

106-
// BAD: Key size is less than 256
107-
KeyPairGenerator keyPairGen8 = KeyPairGenerator.getInstance("EC");
122+
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("EC");
108123
ECGenParameterSpec ecSpec3 = new ECGenParameterSpec("X9.62 prime192v2"); // $ hasInsufficientKeySize
109-
keyPairGen8.initialize(ecSpec3);
124+
keyPairGen5.initialize(ecSpec3);
110125

111-
// BAD: Key size is less than 256
112-
KeyPairGenerator keyPairGen9 = KeyPairGenerator.getInstance("EC");
126+
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("EC");
113127
ECGenParameterSpec ecSpec4 = new ECGenParameterSpec("X9.62 c2tnb191v3"); // $ hasInsufficientKeySize
114-
keyPairGen9.initialize(ecSpec4);
128+
keyPairGen6.initialize(ecSpec4);
115129

116-
// BAD: Key size is less than 256
117-
KeyPairGenerator keyPairGen10 = KeyPairGenerator.getInstance("EC");
130+
KeyPairGenerator keyPairGen7 = KeyPairGenerator.getInstance("EC");
118131
ECGenParameterSpec ecSpec5 = new ECGenParameterSpec("sect163k1"); // $ hasInsufficientKeySize
119-
keyPairGen10.initialize(ecSpec5);
132+
keyPairGen7.initialize(ecSpec5);
120133

121-
// GOOD: Key size is no less than 256
122-
KeyPairGenerator keyPairGen11 = KeyPairGenerator.getInstance("EC");
123-
ECGenParameterSpec ecSpec6 = new ECGenParameterSpec("X9.62 c2tnb359v1");
124-
keyPairGen11.initialize(ecSpec6); // Safe
134+
KeyPairGenerator keyPairGen8 = KeyPairGenerator.getInstance("EC");
135+
ECGenParameterSpec ecSpec6 = new ECGenParameterSpec("X9.62 c2tnb359v1"); // Safe: Key size is no less than 256
136+
keyPairGen8.initialize(ecSpec6);
125137

126-
// BAD: Key size is less than 256
127-
KeyPairGenerator keyPairGen12 = KeyPairGenerator.getInstance("EC");
138+
KeyPairGenerator keyPairGen9 = KeyPairGenerator.getInstance("EC");
128139
ECGenParameterSpec ecSpec7 = new ECGenParameterSpec("prime192v2"); // $ hasInsufficientKeySize
129-
keyPairGen12.initialize(ecSpec7);
140+
keyPairGen9.initialize(ecSpec7);
130141

131-
// GOOD: Key size is no less than 256
132-
KeyPairGenerator keyPairGen13 = KeyPairGenerator.getInstance("EC");
133-
ECGenParameterSpec ecSpec8 = new ECGenParameterSpec("prime256v1");
134-
keyPairGen13.initialize(ecSpec8); // Safe
142+
KeyPairGenerator keyPairGen10 = KeyPairGenerator.getInstance("EC");
143+
ECGenParameterSpec ecSpec8 = new ECGenParameterSpec("prime256v1"); // Safe: Key size is no less than 256
144+
keyPairGen10.initialize(ecSpec8);
135145

136-
// BAD: Key size is less than 256
137146
KeyPairGenerator keyPairGen14 = KeyPairGenerator.getInstance("EC");
138147
ECGenParameterSpec ecSpec9 = new ECGenParameterSpec("c2tnb191v1"); // $ hasInsufficientKeySize
139148
keyPairGen14.initialize(ecSpec9);
140149

141-
// GOOD: Key size is no less than 256
142150
KeyPairGenerator keyPairGen15 = KeyPairGenerator.getInstance("EC");
143151
ECGenParameterSpec ecSpec10 = new ECGenParameterSpec("c2tnb431r1");
144-
keyPairGen15.initialize(ecSpec10); // Safe
145-
}
146-
147-
// ! FN Testing Additions:
148-
149-
// Test local variable usage - Symmetric
150-
{
151-
final int size1 = 64; // compile-time constant
152-
int size2 = 64; // NOT a compile-time constant
153-
154-
// BAD: Key size is less than 128
155-
KeyGenerator keyGen3 = KeyGenerator.getInstance("AES");
156-
keyGen3.init(size1); // $ hasInsufficientKeySize
152+
keyPairGen15.initialize(ecSpec10); // Safe: Key size is no less than 256
157153

158-
// BAD: Key size is less than 128
159-
KeyGenerator keyGen4 = KeyGenerator.getInstance("AES");
160-
keyGen4.init(size2); // $ hasInsufficientKeySize
154+
/* Test variables passed to another method */
155+
ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp112r1"); // $ hasInsufficientKeySize
156+
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("EC"); // MISSING: test KeyGenerator variable as argument
157+
testAsymmetricEC(ecSpec, keyPairGen); // test spec as an argument
161158
}
162-
163-
// Test local variable usage - Asymmetric, Not EC
164-
{
165-
final int size1 = 1024; // compile-time constant
166-
int size2 = 1024; // NOT a compile-time constant
167-
168-
// BAD: Key size is less than 2048
169-
KeyPairGenerator keyPairGen18 = KeyPairGenerator.getInstance("RSA");
170-
keyPairGen18.initialize(size1); // $ hasInsufficientKeySize
171-
172-
// BAD: Key size is less than 2048
173-
KeyPairGenerator keyPairGen19 = KeyPairGenerator.getInstance("RSA");
174-
keyPairGen19.initialize(size2); // $ hasInsufficientKeySize
175-
}
176-
177-
178-
// Test variable passed to other method(s) - Symmetric
179-
{
180-
int size = 64; // test integer variable
181-
KeyGenerator keyGen = KeyGenerator.getInstance("AES"); // test KeyGenerator variable
182-
testSymmetric(size, keyGen); // test with variable as key size
183-
testSymmetric2(64); // test with int literal as key size
184-
}
185-
186-
187-
// Test variables passed to other method(s) - Asymmetric, Not EC
188-
{
189-
int size = 1024; // test integer variable
190-
KeyPairGenerator keyPairGen21 = KeyPairGenerator.getInstance("RSA"); // test KeyPairGenerator variable
191-
testAsymmetricNonEC(size, keyPairGen21); // test with variable as key size
192-
testAsymmetricNonEC2(1024); // test with int literal as key size
193-
}
194-
195-
// Test variable passed to other method(s) - Asymmetric, EC
196-
{
197-
ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp112r1"); // $ hasInsufficientKeySize // test ECGenParameterSpec variable
198-
KeyPairGenerator keyPairGen22 = KeyPairGenerator.getInstance("EC"); // test KeyPairGenerator variable
199-
testAsymmetricEC(ecSpec, keyPairGen22);
200-
201-
}
202-
203159
}
204160

205-
public static void testSymmetric(int keySize, KeyGenerator kg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
206-
// BAD: Key size is less than 2048
161+
public static void testSymmetricVariable(int keySize, KeyGenerator kg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
207162
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
208163
keyGen.init(keySize); // $ hasInsufficientKeySize
209-
210-
// BAD: Key size is less than 2048
211164
kg.init(64); // $ MISSING: hasInsufficientKeySize
212165
}
213166

214-
//! refactor this to use expected-value tag and combine with above method
215-
public static void testSymmetric2(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
216-
// BAD: Key size is less than 2048
167+
public static void testSymmetricInt(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
217168
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
218169
keyGen.init(keySize); // $ hasInsufficientKeySize
219170
}
220171

221-
public static void testAsymmetricNonEC(int keySize, KeyPairGenerator kpg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
222-
// BAD: Key size is less than 2048
172+
public static void testAsymmetricNonEcVariable(int keySize, KeyPairGenerator kpg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
223173
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
224174
keyPairGen.initialize(keySize); // $ hasInsufficientKeySize
225-
226-
// BAD: Key size is less than 2048
227175
kpg.initialize(1024); // $ MISSING: hasInsufficientKeySize
228176
}
229177

230-
//! refactor this to use expected-value tag and combine with above method
231-
public static void testAsymmetricNonEC2(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
232-
// BAD: Key size is less than 2048
178+
public static void testAsymmetricNonEcInt(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
233179
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
234180
keyPairGen.initialize(keySize); // $ hasInsufficientKeySize
235181
}
236182

237-
public static void testAsymmetricEC(ECGenParameterSpec spec, KeyPairGenerator kpg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
238-
// BAD: Key size is less than 256
183+
public static void testAsymmetricEcVariable(ECGenParameterSpec spec, KeyPairGenerator kpg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
239184
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("EC");
240-
keyPairGen.initialize(spec); // sink is now at above where `spec` variable is initialized
185+
keyPairGen.initialize(spec); // sink is above where `spec` variable is initialized
241186

242-
// BAD: Key size is less than 256
243187
ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp112r1"); // $ hasInsufficientKeySize
244-
kpg.initialize(ecSpec);
188+
kpg.initialize(ecSpec); // MISSING: test KeyGenerator variable as argument
245189
}
246190

247-
// ToDo testing:
248-
// ? todo #1: add tests for keysize variable passed to specs - not needed if spec is sink now
249-
// ? todo #3: add test for retrieving a key from elsewhere?
250-
// ? todo #4: add barrier-guard tests (see FP from OpenIdentityPlatform/OpenAM)
251-
// ? todo #5: add tests for updated keysize variable?: e.g. keysize = 1024; keysize += 1024; so when it's used it is correctly 2048.
252-
// ? todo #6: consider if some flow paths for keysize variables will be too hard to track how the keysize is updated (e.g. if calling some other method to get keysize, etc....)
191+
public static void testAsymmetricEcInt(int keySize) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
192+
KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("EC");
193+
keyPairGen.initialize(keySize); // $ hasInsufficientKeySize
194+
}
195+
196+
// public static void testVariable(int keySize, KeyGenerator kg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
197+
// KeyGenerator keyGen = KeyGenerator.getInstance("AES");
198+
// keyGen.init(keySize); // $ hasInsufficientKeySize
199+
200+
// // BAD: Key size is less than 2048
201+
// kg.init(64); // $ MISSING: hasInsufficientKeySize
202+
// }
203+
204+
// public static void testInt(int keySize, KeyGenerator kg) throws java.security.NoSuchAlgorithmException, java.security.InvalidAlgorithmParameterException {
205+
// }
253206
}

0 commit comments

Comments
 (0)