BADFUNC.WEAKCRYPTO : Weak Cryptography

Summary

A use of one of the following functions, which are cryptographically weak and thus should not be relied on for secure applications..

DES family (checking does not treat DES_ prefix on function names as case-sensitive).

• DES_ecb_encrypt(), DES_ecb2_encrypt()
• DES_xcbc_encrypt(), DES_ncbc_encrypt(), DES_pcbc_encrypt()
• DES_cfb_encrypt(), DES_ofb_encrypt(), DES_cfb64_encrypt(), DES_ofb64_encrypt()
• DES_ede2_cbc_encrypt(), DES_ede2_cfb64_encrypt(), DES_ede2_ofb64_encrypt()
• DES_crypt(), DES_fcrypt()

MD5 family

• MD2(), MD4(), MD5()
• MD2_Init(), MD4_Init(), MD5_Init()
• MD2_Update(), MD4_Update(), MD5_Update()
• MD2_Final(), MD4_Final(), MD5_Final()

See also Use of crypt.

Properties

WARNING_FILTER += allow class="Weak Cryptography"

Example

#include <openssl/md2.h>

void weakcrypto(MD2_CTX *ctx){
  if (MD2_Init(ctx)){  /* 'Weak Cryptography' warning issued here */
    /* ... */
  }
  /* ... */
}

Relevant Configuration File Parameters

This class is implemented using a BAD_FUNCTION_* rule set in the general template configuration file.

• To include an additional function or set of functions in the checks for this class, create a new set of BAD_FUNCTION_* rules in which the BAD_FUNCTION_REGEX setting matches the function or set of functions you want to check and the remaining rules match those in the other sets for this class.
• To remove a function or set of functions from the checks for this class, edit the configuration file to comment out the corresponding set of BAD_FUNCTION_* rules.

The following configuration file parameters affect checks for this warning class.

• BAD_FUNCTION_BASE_RANK
• BAD_FUNCTION_CATEGORIES
• BAD_FUNCTION_INFO
• BAD_FUNCTION_LINK
• BAD_FUNCTION_MESSAGE
• BAD_FUNCTION_RANK
• BAD_FUNCTION_REGEX
• BAD_FUNCTION_SIGNIFICANCE
• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER