Description

This detector identifies Go code that generates RSA keys with weak key sizes (typically less than 2048 bits). Weak RSA keys are vulnerable to brute force attacks and cryptographic breaches, compromising the security of encrypted data and digital signatures.

Detection Strategy

• The Go code must import the 'crypto/rsa' library

• Code calls the RSA key generation function (rsa.GenerateKey or aliased equivalent)

• The key size parameter (second argument to GenerateKey) is statically determinable

• The resolved key size value is considered weak (implementation checks against minimum secure threshold)

• All conditions must be met simultaneously for a vulnerability to be reported

Vulnerable code example

package main

import (
	"crypto/rand"
	"crypto/rsa"
)

func main() {...

✅ Secure code example

package main

import (
	"crypto/rand"
	"crypto/rsa"
)

func main() {...