codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Java: Add RSA/ECB/OEAP ciphers to the list of secure algorithms

Open grakshith opened this issue 9 months ago • 0 comments

This PR adds the ciphers RSA/ECB/OAEPWithSHA-1AndMGF1Padding and RSA/ECB/OAEPWithSHA-256AndMGF1Padding to the list of secure algorithms.

CodeQL flags the uses of these ciphers as risky/weak because it sees ECB in the cipher name and matches the regex from the getInsecureAlgorithmRegex() function.

The ciphers listed above are part of the Java Cryptographic Architecture and Java Security Standard, and after a quick google search it appears that none of the security providers operate RSA in the block mode. So ECB in the context of RSA is a misnomer.

I did omit the other algorithm RSA/ECB/PKCS1Padding as I believe PKCS1 padding is weaker compared to OAEP.

References

List of supported ciphers from the Java Security API Java Security Spec Stack overflow thread Another thread

grakshith avatar May 13 '24 18:05 grakshith