logo

Database

Scala Insecure Ec Key

Description

Detects the use of potentially insecure Elliptic Curve cryptography specifications in Scala code. Using weak EC parameters can compromise the cryptographic security of the system by making it vulnerable to attacks that could break the encryption.

Weakness:

052 - Insecure encryption algorithm

Category: Information Collection

Detection Strategy

    • Identifies instantiations of ECGenParameterSpec class from java.security.spec package

    • Examines the string parameter passed to ECGenParameterSpec constructor

    • Reports a vulnerability if the constructor argument specifies insecure elliptic curve parameters

    • Checks for the class usage through multiple import variations including fully qualified and short names

Vulnerable code example

import java.security.spec.RSAKeyGenParameterSpec;
import java.security.KeyPairGenerator;

public class WeakRSA {
    public static void main(String[] args) throws Exception {
        // Vulnerable: Using 1024-bit RSA key length is cryptographically weak
        RSAKeyGenParameterSpec weakSpec = new RSAKeyGenParameterSpec(1024, RSAKeyGenParameterSpec.F4);
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");...

✅ Secure code example

import java.security.spec.RSAKeyGenParameterSpec;
import java.security.KeyPairGenerator;

public class SecureRSA {
    public static void main(String[] args) throws Exception {
        // Using 2048-bit RSA key length for adequate security
        RSAKeyGenParameterSpec strongSpec = new RSAKeyGenParameterSpec(2048, RSAKeyGenParameterSpec.F4);
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");...