Description

This detector identifies the use of insecure elliptic curves in Go cryptographic key generation. Specifically, it flags calls to `elliptic.GenerateKey` or `ecdsa.GenerateKey` when the first argument (the curve parameter) resolves to `elliptic.P224`, which is considered a weak/insecure curve due to its insufficient security margin compared to stronger alternatives like P256, P384, or P521.

Detection Strategy

• Scan Go source files for imports of the `crypto/elliptic` package. If this package is not imported, no analysis is performed. Resolve any import aliases used for both `crypto/elliptic` and `crypto/ecdsa`.

• Identify all function call expressions matching `elliptic.GenerateKey` or `ecdsa.GenerateKey` (accounting for any import aliases resolved in the previous step).

• For each matching function call, extract the first argument (the elliptic curve parameter) and trace its definition to determine which curve is being used.

• A vulnerability is reported when the first argument of the key generation call resolves to a method invocation of `elliptic.P224` (again accounting for import aliases), indicating the use of the weak 224-bit curve.

Vulnerable code example

package signer

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/sha256"
)...

✅ Secure code example

package signer

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/sha256"
)...