Description

This detector identifies the use of insecure (weak) elliptic curves in Python cryptographic code. Using weak elliptic curves (e.g., curves with small key sizes or known vulnerabilities) in EC-based cryptography can expose applications to attacks that break confidentiality, integrity, or authentication guarantees provided by the cryptographic scheme.

Detection Strategy

• Scan for imports from known elliptic curve cryptography libraries (e.g., `cryptography`, `pyOpenSSL`, or similar EC-capable libraries). Only files that import from these specific libraries are analyzed further.

• Identify function or method call expressions in the code that match known EC curve instantiation or configuration sinks (e.g., functions used to specify or select an elliptic curve). The set of dangerous sinks is determined dynamically based on what was actually imported from the tracked libraries.

• For each matching call expression, inspect the arguments passed to the sink function to determine whether a weak or insecure elliptic curve name/constant is being used (e.g., curves with insufficient security level such as `sect163k1`, `prime192v1`, or other curves below recommended key size thresholds). A report is generated only when both conditions are met: the call targets a recognized EC sink AND the curve argument is considered insecure.

Vulnerable code example

import ecdsa
from Crypto.PublicKey import ECC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from ecdsa import NIST256p, SigningKey

LEGACY_CURVE = ec.SECT163K1()
...

✅ Secure code example

import ecdsa
from Crypto.PublicKey import ECC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec
from ecdsa import NIST256p, SigningKey

LEGACY_CURVE = ec.SECP256R1()  # replaced weak binary-field curve with P-256
...