Use of a broken or weak cryptographic algorithm¶
ID: py/weak-cryptographic-algorithm
Kind: path-problem
Severity: warning
Precision: high
Tags:
- security
- external/cwe/cwe-327
Query suites:
- python-code-scanning.qls
- python-security-extended.qls
- python-security-and-quality.qls
Click to see the query in the CodeQL repository
Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted or forged by an attacker.
Many cryptographic algorithms provided by cryptography libraries are known to be weak, or flawed. Using such an algorithm means that encrypted or hashed data is less secure than it appears to be.
Recommendation¶
Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048 for encryption, and SHA-2 or SHA-3 for secure hashing.
Example¶
The following code uses the pycrypto
library to encrypt some secret data. When you create a cipher using pycrypto
you must specify the encryption algorithm to use. The first example uses DES, which is an older algorithm that is now considered weak. The second example uses AES, which is a stronger modern algorithm.
from Crypto.Cipher import DES, AES
cipher = DES.new(SECRET_KEY)
def send_encrypted(channel, message):
channel.send(cipher.encrypt(message)) # BAD: weak encryption
cipher = AES.new(SECRET_KEY)
def send_encrypted(channel, message):
channel.send(cipher.encrypt(message)) # GOOD: strong encryption
WARNING: Although the second example above is more robust, pycrypto is no longer actively maintained so we recommend using cryptography
instead.
References¶
NIST, FIPS 140 Annex a: Approved Security Functions.
NIST, SP 800-131A: Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths.
Common Weakness Enumeration: CWE-327.