codeql
codeql copied to clipboard
Java: Add RSA/ECB/OEAP ciphers to the list of secure algorithms
This PR adds the ciphers RSA/ECB/OAEPWithSHA-1AndMGF1Padding
and RSA/ECB/OAEPWithSHA-256AndMGF1Padding
to the list of secure algorithms.
CodeQL flags the uses of these ciphers as risky/weak because it sees ECB in the cipher name and matches the regex from the getInsecureAlgorithmRegex()
function.
The ciphers listed above are part of the Java Cryptographic Architecture and Java Security Standard, and after a quick google search it appears that none of the security providers operate RSA in the block mode. So ECB in the context of RSA is a misnomer.
I did omit the other algorithm RSA/ECB/PKCS1Padding
as I believe PKCS1 padding is weaker compared to OAEP.
References
List of supported ciphers from the Java Security API Java Security Spec Stack overflow thread Another thread