BrokenCryptoAlgorithm.qhelp

<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
     <overview>
		<p>
			Using broken or weak cryptographic algorithms may compromise
			security guarantees such as confidentiality, integrity, and
			authenticity.
		</p>

		<p>
			Many cryptographic algorithms are known to be weak or flawed. The
			security guarantees of a system often rely on the underlying
			cryptography, so using a weak algorithm can have severe consequences.
			For example:
		</p>

		<ul>
			<li>
			If a weak encryption algorithm is used, an attacker may be able to
			decrypt sensitive data.
			</li>
			<li>
			If a weak algorithm is used for digital signatures, an attacker may
			be able to forge signatures and impersonate legitimate users.
			</li>
		</ul>

          <p>
               This query alerts on any use of a weak cryptographic algorithm that is
               not a hashing algorithm. Use of broken or weak cryptographic hash
               functions are handled by the
               <code>rust/weak-sensitive-data-hashing</code> query.
          </p>

     </overview>
     <recommendation>

          <p>
               Ensure that you use a strong, modern cryptographic
               algorithm, such as AES-128 or RSA-2048.
          </p>

     </recommendation>
     <example>

          <p>
               The following code uses the <code>des</code> crate from the
               <code>RustCrypto</code> family to encrypt some secret data. The
               DES algorithm is old and considered very weak.
          </p>

          <sample src="BrokenCryptoAlgorithmBad.rs" />

          <p>
               Instead, we should use a strong modern algorithm. In this
               case, we have selected the 256-bit version of the AES
               algorithm.
          </p>

          <sample src="BrokenCryptoAlgorithmGood.rs" />

     </example>

     <references>
          <li>NIST, FIPS 140 Annex A: <a href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf"> Approved Security Functions</a>.</li>
          <li>NIST, SP 800-131A Revision 2: <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf">Transitioning the Use of Cryptographic Algorithms and Key Lengths</a>.</li>
          <li>OWASP: <a
          href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms"> Cryptographic Storage Cheat Sheet - Algorithms</a>.
          </li>
     </references>

</qhelp>