Description

This detector identifies insufficient key derivation function (KDF) output lengths in Go applications. When cryptographic key derivation functions generate keys that are too short, they become vulnerable to brute-force attacks and compromise the security of encryption systems.

Detection Strategy

• Scans Go source code for imports of KDF libraries: golang.org/x/crypto/pbkdf2, golang.org/x/crypto/scrypt, and golang.org/x/crypto/argon2

• Identifies calls to key derivation functions: pbkdf2.Key(), scrypt.Key(), argon2.Key(), and argon2.IDKey()

• Examines the key length parameter (4th argument for pbkdf2.Key, 6th argument for scrypt.Key and argon2 functions)

• Reports vulnerability when the key length parameter is determined to be dangerously short through static analysis

• Additional validation checks that the first argument (typically password/secret) contains potentially sensitive data

Vulnerable code example

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"golang.org/x/crypto/argon2"
	"golang.org/x/crypto/pbkdf2"
	"golang.org/x/crypto/scrypt"...

✅ Secure code example

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"golang.org/x/crypto/argon2"
	"golang.org/x/crypto/pbkdf2"
	"golang.org/x/crypto/scrypt"...