Description

Detects the usage of insecure random number generators for cryptographic keys, IVs, nonces and salts in Scala code. Using weak random number generators for cryptographic material can result in predictable values, making the encryption vulnerable to attacks.

Detection Strategy

• Check if javax.crypto package is imported in the source code

• Look for javax.crypto.spec objects (SecretKeySpec, IvParameterSpec, GCMParameterSpec, ChaCha20ParameterSpec, DESKeySpec, DESedeKeySpec, PBEKeySpec, PBEParameterSpec) built from key, IV, nonce or salt material

• Report vulnerability when that material comes from java.util.Random, scala.util.Random or Math.random() instead of SecureRandom

Vulnerable code example

import java.util.Random
import javax.crypto.spec.{GCMParameterSpec, SecretKeySpec}
import javax.crypto.Cipher

object WeakCrypto {
  def encryptInsecure(data: Array[Byte]): Array[Byte] = {
    // VULNERABLE: Using predictable Random() for IV generation instead of SecureRandom
    val ivBytes = new Array[Byte](12)...

✅ Secure code example

import java.security.SecureRandom
import javax.crypto.spec.{GCMParameterSpec, SecretKeySpec}
import javax.crypto.Cipher

object SecureCrypto {
  def encryptSecure(data: Array[Byte]): Array[Byte] = {
    // Use SecureRandom for cryptographically secure random numbers
    val secureRandom = new SecureRandom()...