Skip to content

Commit e5982f1

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
minor updates
1 parent 961e5c7 commit e5982f1

File tree

6 files changed

+23
-224
lines changed

6 files changed

+23
-224
lines changed

‎java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ private int getNodeIntValue(DataFlow::Node node) {
6161
result = node.asExpr().(IntegerLiteral).getIntValue()
6262
}
6363

64-
/** Returns the key size from an EC algorithm curve name string */
64+
/** Returns the key size from an EC algorithm's curve name string */
6565
bindingset[algorithm]
6666
private int getEcKeySize(string algorithm) {
6767
algorithm.matches("sec%") and // specification such as "secp256r1"
@@ -145,16 +145,17 @@ private class SymmetricInitMethodAccess extends KeyGenInitMethodAccess {
145145
SymmetricInitMethodAccess() { this.getMethod() instanceof KeyGeneratorInitMethod }
146146
}
147147

148-
/** An instance of a key generator. */
149-
abstract private class KeyGeneratorObject extends CryptoAlgoSpec {
148+
/** An instance of a generator that specifies an encryption algorithm. */
149+
abstract private class AlgoGeneratorObject extends CryptoAlgoSpec {
150+
/** Returns an uppercase string representing the algorithm name specified by this generator object. */
150151
string getAlgoName() { result = this.getAlgoSpec().(StringLiteral).getValue().toUpperCase() }
151152
}
152153

153154
/**
154155
* An instance of a `java.security.KeyPairGenerator`
155156
* or of a `java.security.AlgorithmParameterGenerator`.
156157
*/
157-
private class AsymmetricKeyGenerator extends KeyGeneratorObject {
158+
private class AsymmetricKeyGenerator extends AlgoGeneratorObject {
158159
AsymmetricKeyGenerator() {
159160
this instanceof JavaSecurityKeyPairGenerator or
160161
this instanceof JavaSecurityAlgoParamGenerator
@@ -164,7 +165,7 @@ private class AsymmetricKeyGenerator extends KeyGeneratorObject {
164165
}
165166

166167
/** An instance of a `javax.crypto.KeyGenerator`. */
167-
private class SymmetricKeyGenerator extends KeyGeneratorObject {
168+
private class SymmetricKeyGenerator extends AlgoGeneratorObject {
168169
SymmetricKeyGenerator() { this instanceof JavaxCryptoKeyGenerator }
169170

170171
override Expr getAlgoSpec() { result = this.getAlgoSpec() }

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySize.qhelp

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,19 @@
66
<overview>
77
<p>Modern encryption relies on the computational infeasibility of breaking a cipher and decoding its
88
message without the key. As computational power increases, the ability to break ciphers grows, and key
9-
sizes need to become larger as a result. Encryption algorithms that use too small of a key size are
9+
sizes need to become larger as a result. Cryptographic algorithms that use too small of a key size are
1010
vulnerable to brute force attacks, which can reveal sensitive data.</p>
1111
</overview>
1212

1313
<recommendation>
14-
<p>Use a key of the recommended size or larger. The key size should be at least 2048 bits for RSA or
15-
DSA encryption, 256 bits for elliptic curve (EC) encryption, and 128 bits for symmetric encryption,
16-
such as AES.</p>
14+
<p>Use a key of the recommended size or larger. The key size should be at least 128 bits for AES encryption,
15+
256 bits for elliptic-curve cryptography (ECC), and 2048 bits for RSA, DSA, or DH encryption.</p>
1716
</recommendation>
1817

1918
<example>
2019

2120
<p>
22-
The following code uses encryption with insufficient key sizes.
21+
The following code uses cryptographic algorithms with insufficient key sizes.
2322
</p>
2423

2524
<sample src="InsufficientKeySizeBad.java" />
@@ -29,12 +28,6 @@
2928
larger for each algorithm.
3029
</p>
3130

32-
<!-- <p>
33-
In the example below, the key sizes are set correctly.
34-
</p>
35-
36-
<sample src="InsufficientKeySizeGood.java" /> -->
37-
3831
</example>
3932

4033
<references>
@@ -45,22 +38,6 @@
4538
<li>
4639
Wikipedia: <a href="https://en.wikipedia.org/wiki/Strong_cryptography">Strong cryptography</a>.
4740
</li>
48-
<!-- <li>
49-
Wikipedia:
50-
<a href="https://en.wikipedia.org/wiki/RSA_(cryptosystem)">RSA (cryptosystem)</a>.
51-
</li>
52-
<li>
53-
Wikipedia:
54-
<a href="https://en.wikipedia.org/wiki/Digital_Signature_Algorithm">Digital Signature Algorithm</a>.
55-
</li>
56-
<li>
57-
Wikipedia:
58-
<a href="https://en.wikipedia.org/wiki/Elliptic-curve_cryptography">Elliptic-curve cryptography</a>.
59-
</li>
60-
<li>
61-
Wikipedia:
62-
<a href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">Advanced Encryption Standard</a>.
63-
</li> -->
6441
<li>
6542
OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms">
6643
Cryptographic Storage Cheat Sheet</a>.

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySizeBad.java

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("RSA");
2-
// BAD: Key size is less than 2048
3-
keyPairGen1.initialize(1024);
2+
keyPairGen1.initialize(1024); // BAD: Key size is less than 2048
43

54
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
6-
// BAD: Key size is less than 2048
7-
keyPairGen2.initialize(1024);
5+
keyPairGen2.initialize(1024); // BAD: Key size is less than 2048
86

9-
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("EC");
10-
// BAD: Key size is less than 256
11-
ECGenParameterSpec ecSpec1 = new ECGenParameterSpec("secp112r1");
12-
keyPairGen3.initialize(ecSpec1);
7+
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
8+
keyPairGen3.initialize(1024); // BAD: Key size is less than 2048
9+
10+
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("EC");
11+
ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp112r1"); // BAD: Key size is less than 256
12+
keyPairGen4.initialize(ecSpec);
1313

1414
KeyGenerator keyGen = KeyGenerator.getInstance("AES");
15-
// BAD: Key size is less than 128
16-
keyGen.init(64);
15+
keyGen.init(64); // BAD: Key size is less than 128

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySizeGood.java

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ public void keySizeTesting() throws java.security.NoSuchAlgorithmException, java
4444
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("RSA");
4545
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
4646

47+
/* Test spec */
4748
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("RSA");
4849
RSAKeyGenParameterSpec rsaSpec = new RSAKeyGenParameterSpec(1024, null); // $ hasInsufficientKeySize
4950
keyPairGen3.initialize(rsaSpec);
@@ -80,6 +81,7 @@ public void keySizeTesting() throws java.security.NoSuchAlgorithmException, java
8081
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
8182
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
8283

84+
/* Test spec */
8385
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DSA");
8486
DSAGenParameterSpec dsaSpec = new DSAGenParameterSpec(1024, 0); // $ hasInsufficientKeySize
8587
keyPairGen3.initialize(dsaSpec);
@@ -101,6 +103,7 @@ public void keySizeTesting() throws java.security.NoSuchAlgorithmException, java
101103
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DH");
102104
keyPairGen2.initialize(2048); // Safe: Key size is no less than 2048
103105

106+
/* Test spec */
104107
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
105108
DHGenParameterSpec dhSpec = new DHGenParameterSpec(1024, 0); // $ hasInsufficientKeySize
106109
keyPairGen3.initialize(dhSpec);

‎java/ql/test/query-tests/security/CWE-326/SignatureTest.java

Lines changed: 1 addition & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -1,196 +1,31 @@
1-
//package org.bouncycastle.jce.provider.test;
1+
/* Adds tests to check for FPs related to RSA/DSA versus EC */
22

33
import java.security.KeyPair;
44
import java.security.KeyPairGenerator;
55
import java.security.SecureRandom;
66
import java.security.Security;
77
import java.security.Signature;
88

9-
// import org.bouncycastle.asn1.cryptopro.CryptoProObjectIdentifiers;
10-
// import org.bouncycastle.jce.provider.BouncyCastleProvider;
11-
// import org.bouncycastle.jce.spec.ECNamedCurveGenParameterSpec;
12-
// import org.bouncycastle.jce.spec.GOST3410ParameterSpec;
13-
// import org.bouncycastle.util.encoders.Hex;
14-
// import org.bouncycastle.util.test.SimpleTest;
15-
169
public class SignatureTest
17-
//extends SimpleTest
1810
{
19-
// private static final byte[] DATA = Hex.decode("00000000deadbeefbeefdeadffffffff00000000");
20-
21-
private void checkSig(KeyPair kp, String name)
22-
throws Exception
23-
{
24-
// Signature sig = Signature.getInstance(name, "BC");
25-
26-
// sig.initSign(kp.getPrivate());
27-
// sig.update(DATA);
28-
29-
// byte[] signature1 = sig.sign();
30-
31-
// sig.update(DATA);
32-
33-
// byte[] signature2 = sig.sign();
34-
35-
// sig.initVerify(kp.getPublic());
36-
37-
// sig.update(DATA);
38-
// if (!sig.verify(signature1))
39-
// {
40-
// fail("did not verify: " + name);
41-
// }
42-
43-
// // After verify, should be reusable as if we are after initVerify
44-
// sig.update(DATA);
45-
// if (!sig.verify(signature1))
46-
// {
47-
// fail("second verify failed: " + name);
48-
// }
49-
50-
// sig.update(DATA);
51-
// if (!sig.verify(signature2))
52-
// {
53-
// fail("second verify failed (2): " + name);
54-
// }
55-
}
5611

5712
public void performTest()
5813
throws Exception
5914
{
6015
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
61-
6216
kpGen.initialize(2048); // Safe
63-
6417
KeyPair kp = kpGen.generateKeyPair();
6518

66-
checkSig(kp, "SHA1withRSA");
67-
checkSig(kp, "SHA224withRSA");
68-
checkSig(kp, "SHA256withRSA");
69-
checkSig(kp, "SHA384withRSA");
70-
checkSig(kp, "SHA512withRSA");
71-
72-
checkSig(kp, "SHA3-224withRSA");
73-
checkSig(kp, "SHA3-256withRSA");
74-
checkSig(kp, "SHA3-384withRSA");
75-
checkSig(kp, "SHA3-512withRSA");
76-
77-
checkSig(kp, "MD2withRSA");
78-
checkSig(kp, "MD4withRSA");
79-
checkSig(kp, "MD5withRSA");
80-
checkSig(kp, "RIPEMD160withRSA");
81-
checkSig(kp, "RIPEMD128withRSA");
82-
checkSig(kp, "RIPEMD256withRSA");
83-
84-
checkSig(kp, "SHA1withRSAandMGF1");
85-
checkSig(kp, "SHA1withRSAandMGF1");
86-
checkSig(kp, "SHA224withRSAandMGF1");
87-
checkSig(kp, "SHA256withRSAandMGF1");
88-
checkSig(kp, "SHA384withRSAandMGF1");
89-
checkSig(kp, "SHA512withRSAandMGF1");
90-
91-
checkSig(kp, "SHA1withRSAandSHAKE128");
92-
checkSig(kp, "SHA1withRSAandSHAKE128");
93-
checkSig(kp, "SHA224withRSAandSHAKE128");
94-
checkSig(kp, "SHA256withRSAandSHAKE128");
95-
checkSig(kp, "SHA384withRSAandSHAKE128");
96-
checkSig(kp, "SHA512withRSAandSHAKE128");
97-
98-
checkSig(kp, "SHA1withRSAandSHAKE256");
99-
checkSig(kp, "SHA1withRSAandSHAKE256");
100-
checkSig(kp, "SHA224withRSAandSHAKE256");
101-
checkSig(kp, "SHA256withRSAandSHAKE256");
102-
checkSig(kp, "SHA384withRSAandSHAKE256");
103-
checkSig(kp, "SHA512withRSAandSHAKE256");
104-
105-
checkSig(kp, "SHAKE128withRSAPSS");
106-
checkSig(kp, "SHAKE256withRSAPSS");
107-
108-
checkSig(kp, "SHA1withRSA/ISO9796-2");
109-
checkSig(kp, "MD5withRSA/ISO9796-2");
110-
checkSig(kp, "RIPEMD160withRSA/ISO9796-2");
111-
112-
// checkSig(kp, "SHA1withRSA/ISO9796-2PSS");
113-
// checkSig(kp, "MD5withRSA/ISO9796-2PSS");
114-
// checkSig(kp, "RIPEMD160withRSA/ISO9796-2PSS");
115-
116-
checkSig(kp, "RIPEMD128withRSA/X9.31");
117-
checkSig(kp, "RIPEMD160withRSA/X9.31");
118-
checkSig(kp, "SHA1withRSA/X9.31");
119-
checkSig(kp, "SHA224withRSA/X9.31");
120-
checkSig(kp, "SHA256withRSA/X9.31");
121-
checkSig(kp, "SHA384withRSA/X9.31");
122-
checkSig(kp, "SHA512withRSA/X9.31");
123-
checkSig(kp, "WhirlpoolwithRSA/X9.31");
124-
12519
kpGen = KeyPairGenerator.getInstance("DSA", "BC");
126-
12720
kpGen.initialize(2048); // Safe
128-
12921
kp = kpGen.generateKeyPair();
13022

131-
checkSig(kp, "SHA1withDSA");
132-
checkSig(kp, "SHA224withDSA");
133-
checkSig(kp, "SHA256withDSA");
134-
checkSig(kp, "SHA384withDSA");
135-
checkSig(kp, "SHA512withDSA");
136-
checkSig(kp, "NONEwithDSA");
137-
13823
kpGen = KeyPairGenerator.getInstance("EC", "BC");
139-
14024
kpGen.initialize(256); // Safe
141-
14225
kp = kpGen.generateKeyPair();
14326

144-
checkSig(kp, "SHA1withECDSA");
145-
checkSig(kp, "SHA224withECDSA");
146-
checkSig(kp, "SHA256withECDSA");
147-
checkSig(kp, "SHA384withECDSA");
148-
checkSig(kp, "SHA512withECDSA");
149-
checkSig(kp, "RIPEMD160withECDSA");
150-
checkSig(kp, "SHAKE128withECDSA");
151-
checkSig(kp, "SHAKE256withECDSA");
152-
15327
kpGen = KeyPairGenerator.getInstance("EC", "BC");
154-
15528
kpGen.initialize(521); // Safe
156-
15729
kp = kpGen.generateKeyPair();
158-
159-
checkSig(kp, "SHA1withECNR");
160-
checkSig(kp, "SHA224withECNR");
161-
checkSig(kp, "SHA256withECNR");
162-
checkSig(kp, "SHA384withECNR");
163-
checkSig(kp, "SHA512withECNR");
164-
165-
// kpGen = KeyPairGenerator.getInstance("ECGOST3410", "BC");
166-
167-
// kpGen.initialize(new ECNamedCurveGenParameterSpec("GostR3410-2001-CryptoPro-A"), new SecureRandom());
168-
169-
// kp = kpGen.generateKeyPair();
170-
171-
// checkSig(kp, "GOST3411withECGOST3410");
172-
173-
// kpGen = KeyPairGenerator.getInstance("GOST3410", "BC");
174-
175-
// GOST3410ParameterSpec gost3410P = new GOST3410ParameterSpec(CryptoProObjectIdentifiers.gostR3410_94_CryptoPro_A.getId());
176-
177-
// kpGen.initialize(gost3410P);
178-
179-
// kp = kpGen.generateKeyPair();
180-
181-
// checkSig(kp, "GOST3411withGOST3410");
182-
}
183-
184-
public String getName()
185-
{
186-
return "SigNameTest";
18730
}
188-
189-
// public static void main(
190-
// String[] args)
191-
// {
192-
// //Security.addProvider(new BouncyCastleProvider());
193-
194-
// //runTest(new SignatureTest());
195-
// }
19631
}

0 commit comments

Comments
 (0)