Description

This detector identifies Ruby code that uses insecure (weak) elliptic curve parameters when generating EC (Elliptic Curve) cryptographic keys via the OpenSSL library. Using weak or deprecated curves (e.g., small key-size curves) can expose encrypted communications or digital signatures to cryptographic attacks, compromising the security of the system.

Detection Strategy

• The detector only activates when the OpenSSL library (or any library with the 'openssl' prefix) is imported/required in the Ruby file. If OpenSSL is not present, no analysis is performed.

• For each candidate code location, the detector inspects EC key generation calls to determine whether a weak or insecure elliptic curve is being specified as the curve parameter (e.g., curves with insufficient security strength or known vulnerabilities).

• A vulnerability is reported when an EC key generation method call is found that uses an insecure curve name/identifier, confirming both the use of OpenSSL and the presence of a weak curve selection in the same code context.

Vulnerable code example

require "openssl"

LEGACY_CURVE = "secp160r1"

class InvoiceSigner
  def sign(invoice)
    key = OpenSSL::PKey::EC.generate("prime192v1") # UNSAFE: P-192 is below 256-bit security
    key.sign(OpenSSL::Digest.new("SHA256"), invoice)...

✅ Secure code example

require "openssl"

SECURE_CURVE = "prime256v1"  # P-256 meets 128-bit security minimum

class InvoiceSigner
  def sign(invoice)
    key = OpenSSL::PKey::EC.generate("prime256v1")  # SAFE: P-256 replaces weak P-192
    key.sign(OpenSSL::Digest.new("SHA256"), invoice)...