Description

This vulnerability detector identifies C# code using insecure cipher algorithms or modes that provide weak cryptographic protection. Weak ciphers like DES, RC2, or insecure modes like ECB can be easily broken, compromising data confidentiality and integrity.

Detection Strategy

• Scans C# source files for calls to CipherUtilities.GetCipher method (excludes test files)

• Examines the first parameter passed to GetCipher to determine the cipher algorithm or mode being used

• Reports a vulnerability when the cipher parameter specifies a known weak or insecure cipher algorithm (such as DES, RC2, or ECB mode)

Vulnerable code example

using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Security;

class VulnerableEncryption
{
    public byte[] EncryptData(byte[] key, byte[] data)
    {...

✅ Secure code example

using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Security;

class SecureEncryption
{
    public byte[] EncryptData(byte[] key, byte[] data)
    {...