Description

Detects the use of insecure cipher modes in cryptographic operations within Scala code. Insecure cipher modes like ECB can make encrypted data vulnerable to pattern analysis and replay attacks, potentially compromising data confidentiality.

Detection Strategy

• Check for calls to Cipher.getInstance() method in Scala code

• Examine the cipher transformation string passed as the first argument to getInstance()

• Flag instances where insecure cipher modes (like ECB) are specified in the transformation string

• Verify the cipher mode is explicitly specified in the transformation parameter

Vulnerable code example

import javax.crypto.Cipher
import javax.crypto.spec.SecretKeySpec

public class InsecureCrypto {
    public static void main(String[] args) {
        try {
            // Vulnerable: Using DES (weak encryption algorithm)
            Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import java.security.SecureRandom;

public class SecureCrypto {
    public static void main(String[] args) {
        try {...