Description

This detector identifies the use of weak or insecure HMAC hashing algorithms in Kotlin code. When an HMAC-related library is imported and a sensitive message is passed to an HMAC function configured with an unsafe/weak algorithm (e.g., MD5, SHA-1), the code is flagged as vulnerable. Using weak hashing algorithms for HMAC operations undermines message integrity and authentication guarantees, making the application susceptible to collision attacks or forgery.

Detection Strategy

• Checks that at least one HMAC-related library (from a predefined set of known HMAC library prefixes) is imported in the Kotlin file. If no such library is present, analysis is skipped entirely.

• For each candidate code location under analysis, identifies the 'sink' — the specific HMAC function call or algorithm specification node — associated with that location.

• Verifies that the input to the HMAC operation is a sensitive message (e.g., a value that represents credentials, tokens, or other security-relevant data), ensuring the analysis is focused on security-critical uses.

• Evaluates whether the HMAC algorithm defined at the sink node is considered unsafe (e.g., HMAC-MD5 or HMAC-SHA1), by checking the algorithm identifier against a list of known weak/insecure algorithm names.

• A vulnerability is reported only when all three conditions are met simultaneously: an HMAC library is imported, the call site involves a sensitive message, and the algorithm used at the sink is deemed unsafe.

Vulnerable code example

import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import org.apache.commons.codec.digest.HmacAlgorithms
import org.apache.commons.codec.digest.HmacUtils

const val ALGORITHM = "HmacSHA1"

fun hashPassword(key: ByteArray, password: String): ByteArray {...

✅ Secure code example

import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import org.apache.commons.codec.digest.HmacAlgorithms
import org.apache.commons.codec.digest.HmacUtils

const val ALGORITHM = "HmacSHA256" // Use SHA-256 instead of broken SHA-1

fun hashPassword(key: ByteArray, password: String): ByteArray {...