logo

Database

Java Weak Crypto In Secretkeyfactory

Description

Detects the use of weak cryptographic algorithms with Java's SecretKeyFactory, which can lead to insecure key generation and reduced cryptographic strength. Using deprecated or weak algorithms like DES makes the encrypted data vulnerable to brute force attacks and compromises security.

Weakness:

264 - Insecure encryption algorithm - TripleDES

Category: Information Collection

Detection Strategy

    • Check for calls to SecretKeyFactory.getInstance() method in Java code

    • Extract the algorithm name parameter passed to getInstance()

    • Compare the algorithm name (case-insensitive) against a list of known insecure cipher algorithms

    • Flag instances where deprecated or weak algorithms like DES are specified as the algorithm parameter

Vulnerable code example

import javax.crypto.SecretKeyFactory;

public class WeakCrypto {
    public void insecureMethod() throws Exception {
        // DES is a weak encryption algorithm vulnerable to brute force attacks
        SecretKeyFactory weakFactory = SecretKeyFactory.getInstance("des");
        
        // RC4 is cryptographically broken and should not be used...

✅ Secure code example

import javax.crypto.SecretKeyFactory;
import java.security.NoSuchAlgorithmException;

public class SecureCrypto {
    public void secureMethod() throws NoSuchAlgorithmException {
        // Use PBKDF2WithHmacSHA256 - strong algorithm for key derivation
        SecretKeyFactory secureFactory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        ...