Description

Detects the use of insecure cipher modes in Java cryptographic operations through Cipher.getInstance() calls. Using weak cipher modes (like ECB) or specifying modes incorrectly can make encryption vulnerable to cryptographic attacks, potentially exposing sensitive data.

Detection Strategy

• Identifies calls to Cipher.getInstance() including variations with javax.crypto and crypto package prefixes

• Examines the first argument passed to getInstance() to check if it specifies an insecure cipher configuration

• Flags instances where the cipher specification string indicates use of insecure modes or algorithms

• Triggers on dangerous patterns like missing mode specifications, ECB mode, or other cryptographically weak configurations

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.net.ssl.SSLContext;
import java.security.MessageDigest;

public class VulnerableExample {
    public void insecureOperations() throws Exception {
        // Using weak/deprecated crypto algorithms...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.spec.GCMParameterSpec;
import javax.net.ssl.SSLContext;
import java.security.MessageDigest;
...