dbeaver
Stop using DES and avoid hardcoded key
Description
Why you need it?
We've identified that in the file SecuredPasswordEncrypter.java, the encryption key is hardcoded, and vulnerable algorithms DES and 3DES are still in use here.
private static final byte[] PASSWORD_ENCRYPTION_KEY = "sdf@!#$verf^wv%6Fwe%$$#FFGwfsdefwfe135s$^H)dg".getBytes(Charset.defaultCharset());
public static final String SCHEME_DESEDE = "DESede";
public static final String SCHEME_DES = "DES";
How could it be?
The hardcoded encryption key may be exposed to the attacker, and the password storage will be insecure. The DES and 3DES have long been regarded as vulnerable. Applying these two algorithms for password storage may not be considered as secure.
DBeaver Version
24.0.3
Operating System
No response
Database and driver
No response
Steps to reproduce
No response
Additional context
No response
But, PASSWORD_ENCRYPTION_KEY can still be found in SecuredPasswordEncrypter.java - is this intentional?
@ckujau yes, it is intentional. Please read the Javadoc. It is only kept for backward compatibility reasons.
https://github.com/dbeaver/dbeaver/blob/6755db48271c2536772ff1de8fe47a26ee54f6ed/plugins/org.jkiss.dbeaver.model/src/org/jkiss/dbeaver/runtime/encode/SecuredPasswordEncrypter.java#L32-L36
