Description

Detects the use of insecure cipher modes in cryptographic operations through Cipher.getInstance() calls. Using weak cipher modes like ECB can make encrypted data vulnerable to cryptanalysis attacks and compromise data confidentiality. This check helps enforce the use of secure cipher modes in cryptographic implementations.

Detection Strategy

• Identifies calls to Cipher.getInstance() in the code (including qualified paths like javax.crypto.Cipher.getInstance)

• Examines the cipher configuration string passed as argument to getInstance()

• Reports a vulnerability if the cipher configuration uses insecure modes or algorithms (e.g. DES/ECB, AES/ECB)

• Validates the cipher configuration against known secure cryptographic standards and best practices

Vulnerable code example

import javax.crypto.Cipher
import java.security.spec.RSAKeyGenParameterSpec
import javax.net.ssl.SSLContext

fun main() {
    // Vulnerable: Using weak DES cipher algorithm
    val cipher = Cipher.getInstance("DES")
    ...

✅ Secure code example

import javax.crypto.Cipher
import java.security.spec.RSAKeyGenParameterSpec
import javax.net.ssl.SSLContext

fun main() {
    // Secure: Using AES with GCM mode for strong encryption
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    ...