CodeQL documentation
CodeQL resources

Use of a broken or weak cryptographic algorithm

ID: rb/weak-cryptographic-algorithm Kind: problem Security severity: 7.5 Severity: warning Precision: high Tags: - security - external/cwe/cwe-327 Query suites: - ruby-code-scanning.qls - ruby-security-extended.qls - ruby-security-and-quality.qls

Click to see the query in the CodeQL repository

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:

  • If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.

  • If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users. This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash functions are handled by the rb/weak-sensitive-data-hashing query.

Recommendation

Ensure that you use a strong, modern cryptographic algorithm, such as AES-128 or RSA-2048.

Example

The following code uses the OpenSSL library to encrypt some secret data. When you create a cipher using OpenSSL you must specify the encryption algorithm to use. The first example uses DES, which is an older algorithm that is now considered weak. The second example uses AES, which is a stronger modern algorithm.

require 'openssl' class Encryptor  attr_accessor :secret_key  def encrypt_message_weak(message)  cipher = OpenSSL::Cipher.new('des') # BAD: weak encryption  cipher.encrypt  cipher.key = secret_key  cipher.update(message)  cipher.final  end  def encrypt_message_strong(message)  cipher = OpenSSL::Cipher::AES128.new # GOOD: strong encryption  cipher.encrypt  cipher.key = secret_key  cipher.update(message)  cipher.final  end end

References