Description

Detects hardcoded salt values in Go's scrypt.Key function calls. Using hardcoded salts in password hashing makes the derived keys predictable and vulnerable to rainbow table attacks, significantly weakening the password security.

Detection Strategy

• Identifies calls to the scrypt.Key function in Go code

• Examines the function arguments to check if the salt parameter is a hardcoded literal value instead of a generated value

• Reports a vulnerability when scrypt.Key is called with a salt that is a constant/literal value in the code

• Example of vulnerable code: scrypt.Key(password, []byte("static_salt"), N, r, p, keyLen)

Vulnerable code example

package main

import (
    "golang.org/x/crypto/scrypt"
)

func main() {
    password := "userpassword"...

✅ Secure code example

package main

import (
    "crypto/rand"
    "golang.org/x/crypto/scrypt"
    "fmt"
)
...