Description

This detector identifies the use of insecure (weak) elliptic curve algorithms in Dart source code. When cryptographic operations rely on weak elliptic curves (e.g., curves with insufficient key sizes or known vulnerabilities), attackers may be able to break the encryption or digital signatures, compromising the confidentiality and integrity of protected data.

Detection Strategy

• Scan for Dart import statements that reference known cryptographic libraries providing elliptic curve functionality (e.g., libraries with prefixes like 'package:elliptic' or other curve-providing packages). The detector only proceeds if at least one such import is present in the file.

• Identify function calls or method invocations in the code that are known sinks for elliptic curve configuration — specifically calls that accept a curve name or curve type as an argument. These sinks are matched against a predefined list of library-prefixed function names that accept a curve parameter.

• For each matching function call, extract the specific curve identifier being passed as an argument. For the 'package:elliptic' library, a dedicated extraction routine is used to retrieve the curve name from the call expression.

• Check the extracted curve identifier against a predefined list of weak or insecure elliptic curves. A vulnerability is reported if the curve being used is considered cryptographically weak (e.g., curves with small key sizes or deprecated/broken curves).

Vulnerable code example

import 'package:basic_utils/basic_utils.dart';
import 'package:elliptic/elliptic.dart' as elliptic;

AsymmetricKeyPair newSessionKeyPair() {
  // UNSAFE: P-192 is below the recommended 256-bit security threshold
  return CryptoUtils.generateEcKeyPair(curve: 'prime192v1');
}
...

✅ Secure code example

import 'package:basic_utils/basic_utils.dart';
import 'package:elliptic/elliptic.dart' as elliptic;

AsymmetricKeyPair newSessionKeyPair() {
  // SAFE: prime256v1 meets the 256-bit security threshold
  return CryptoUtils.generateEcKeyPair(curve: 'prime256v1');
}
...