logo

Database

Java Insecure Aes Cipher Mode

Description

This detector identifies insecure AES cipher modes in Java applications. When AES encryption is configured with weak or vulnerable cipher modes (like ECB), it creates cryptographic vulnerabilities that can compromise data confidentiality and security.

Weakness:

052 - Insecure encryption algorithm

Category: Information Collection

Detection Strategy

    • Reports vulnerabilities when Java code calls Cipher.getInstance() method with insecure AES cipher mode configurations

    • Triggers on method calls that match known cipher instance creation patterns (like Cipher.getInstance)

    • Analyzes the first parameter of the cipher instance method to determine if it specifies an unsafe AES encryption mode

    • Flags code where the cipher mode parameter contains insecure configurations that weaken encryption strength

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;

public class UnauthenticatedEncryption {
    public byte[] encrypt(SecretKey key, byte[] iv, byte[] data) throws Exception {
        Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding"); // Vulnerable: no authentication
        cipher.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(iv));...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;

public class AuthenticatedEncryption {
    public byte[] encrypt(SecretKey key, byte[] iv, byte[] data) throws Exception {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); // Safe: GCM provides authentication
        cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv)); // Use GCMParameterSpec for GCM mode...