Description

Detects the use of potentially insecure elliptic curve cryptography parameters in Java applications. When ECGenParameterSpec is initialized with weak curve specifications, it can result in cryptographic implementations that don't provide adequate security strength, potentially compromising the cryptographic operations.

Detection Strategy

• Identifies instantiations of ECGenParameterSpec class (including fully qualified names)

• Examines the parameter value passed to the ECGenParameterSpec constructor

• Reports a vulnerability if the constructor argument uses known weak or insecure curve specifications

• Checks various import forms including 'java.security.spec.ECGenParameterSpec', 'security.spec.ECGenParameterSpec', and unqualified 'ECGenParameterSpec'

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

public class InsecureCrypto {
    public void vulnerableCode() throws Exception {
        // Insecure - Uses weak ECB mode which doesn't provide proper security
        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import java.security.MessageDigest;
import java.security.SecureRandom;

public class SecureCrypto {...