Description

Detects usage of the obsolete CryptDeriveKey method from RFC2898DeriveBytes class in C# applications. This legacy cryptographic key derivation function is considered insecure and could lead to weak key generation, potentially compromising the security of encrypted data.

Detection Strategy

• Identifies method calls to 'CryptDeriveKey' specifically from the RFC2898DeriveBytes class

• Checks for the method call in various namespace forms including 'System.Security.Cryptography.rfc2898DeriveBytes.CryptDeriveKey'

• Reports a vulnerability when any matching method call is found in the code

• Modern alternatives like using PBKDF2 with proper key lengths should be used instead

Vulnerable code example

using System;
using System.Text;
using System.Security.Cryptography;

class CryptoExample
{
    public void DeriveKey()
    {...

✅ Secure code example

using System;
using System.Text;
using System.Security.Cryptography;

class CryptoExample
{
    public void DeriveKey()
    {...