Description

This vulnerability detector identifies the use of insecure DSA (Digital Signature Algorithm) cryptographic functions in Rust code. DSA functions that use insufficient key sizes (typically less than 2048 bits) or deprecated algorithms are considered cryptographically weak and vulnerable to attacks, potentially compromising the security of digital signatures and authentication mechanisms.

Detection Strategy

• Scans Rust source code for function calls or method invocations that reference DSA-related cryptographic operations

• Checks if these DSA function calls correspond to insecure implementations by examining the function name, module path, or imported crate types

• Identifies usage of DSA functions from specific cryptographic crates that are known to provide weak or deprecated DSA implementations

• Reports a vulnerability when code uses DSA functions that do not meet current cryptographic security standards for key length and algorithm strength

Vulnerable code example

use dsa::{Components, KeySize, SigningKey};
use rand::rngs::OsRng;

fn generate_dsa_params() -> Components {
    // Vulnerable: DSA parameter generation is deprecated in FIPS 186-5
    Components::try_generate_from_rng_with_key_size(&mut OsRng, KeySize::DSA_2048_256).unwrap()
}
...

✅ Secure code example

use ed25519_dalek::SigningKey;
use rand::rngs::OsRng;

// Safe: Use Ed25519 instead of deprecated DSA
fn generate_ed25519_key() -> SigningKey {
    SigningKey::generate(&mut OsRng)
}
...