Use of a broken or weak cryptographic algorithm¶

ID: py/weak-cryptographic-algorithm
Kind: problem
Security severity: 7.5
Severity: warning
Precision: high
Tags:
   - security
   - external/cwe/cwe-327
Query suites:
   - python-code-scanning.qls
   - python-security-extended.qls
   - python-security-and-quality.qls

Click to see the query in the CodeQL repository

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:

• If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.

• If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users. This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash functions are handled by the py/weak-sensitive-data-hashing query.

from Crypto.Cipher import DES, AES

cipher = DES.new(SECRET_KEY)

def send_encrypted(channel, message):
    channel.send(cipher.encrypt(message)) # BAD: weak encryption


cipher = AES.new(SECRET_KEY)

def send_encrypted(channel, message):
    channel.send(cipher.encrypt(message)) # GOOD: strong encryption