Description

Detects the usage of cryptographically weak hash algorithms in elliptic curve operations within PHP code. This vulnerability occurs when insecure hash functions are specified for elliptic curve cryptography operations, which could weaken the overall cryptographic security of the system.

Detection Strategy

• Identifies calls to cryptographic hash configuration methods 'setHash' or 'setMGFHash'

• Checks if the configured hash algorithm is considered cryptographically weak for elliptic curve operations

• Reports a vulnerability when weak hash algorithms are used in elliptic curve cryptographic configurations

Vulnerable code example

<?php
use phpseclib\Crypt\RSA;

$rsa = new RSA();
$plaintext = "sensitive data";

// VULNERABLE: Using weak MD5 hash for RSA encryption
$rsa->setHash('md5');...

✅ Secure code example

<?php
use phpseclib\Crypt\RSA;

$rsa = new RSA();
$plaintext = "sensitive data";

// Use SHA-256 for secure hashing
$rsa->setHash('sha256');  // Strong cryptographic hash...