CodeQL documentation
CodeQL resources

Use of a cryptographic algorithm with insufficient key size

ID: cpp/insufficient-key-size
Kind: path-problem
Security severity: 7.5
Severity: error
Precision: high
Tags:
   - security
   - external/cwe/cwe-326
Query suites:
   - cpp-code-scanning.qls
   - cpp-security-extended.qls
   - cpp-security-and-quality.qls

Click to see the query in the CodeQL repository

Using cryptographic algorithms with a small key size can leave data vulnerable to being decrypted.

Many cryptographic algorithms provided by cryptography libraries can be configured with key sizes that are vulnerable to brute force attacks. Using such a key size means that an attacker may be able to easily decrypt the encrypted data.

Recommendation

Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048.

Example

The following code shows an example of using the openssl library to generate an RSA key. When creating a key, you must specify which key size to use. The first example uses 1024 bits, which is not considered sufficient. The second example uses 2048 bits, which is currently considered sufficient.

void encrypt_with_openssl(EVP_PKEY_CTX *ctx) {

  // BAD: only 1024 bits for an RSA key
  EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 1024);

  // GOOD: 2048 bits for an RSA key
  EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048);
}

References

  • © GitHub, Inc.
  • Terms
  • Privacy