JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.
If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.
If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.
| CodeSonar® 27.0w | AdaCore Inc |
An insecure key derivation function is used.
The iterations of an algorithm during an encryption are very relevant for the safety of encrypted data (for more information see the OWASP documentation on Testing for Weak Encryption).
Some cryptography algorithms are nowadays considered as outdated and unsafe or actually broken, since they are too easy to decode. This checker identifies uses of unsafe algorithms for cryptography.
The OWASP documentation provides more information on Using the Java Cryptographic Extensions.
| Class Name | Insecure Key Derivation (Java) | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Significance | security | ||||||||||||||||||||||||
| Mnemonic | JAVA.CRYPTO.KEY | ||||||||||||||||||||||||
| Categories |
|
||||||||||||||||||||||||
| Availability | Available for Java and Kotlin. | ||||||||||||||||||||||||
| Enabling | Checks for this warning class are enabled by
default. To disable them, add the following WARNING_FILTER rule to the
project configuration file.
WARNING_FILTER += discard class="Insecure Key Derivation (Java)" |
Japanese (ja)
import java.security.NoSuchAlgorithmException;
import java.security.spec.InvalidKeySpecException;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
public class InsecureKeyDerivation {
// A password-based key derivation with only 100 iterations is far too
// cheap: an attacker can brute-force candidate passwords at high speed.
SecretKey deriveWeak(char[] password, byte[] salt)
throws NoSuchAlgorithmException, InvalidKeySpecException {
PBEKeySpec spec = new PBEKeySpec(password, salt, 100, 256); // 'Insecure Key Derivation (Java)' warning issued here
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
return factory.generateSecret(spec);
}
// A high iteration count (here 100,000) makes each guess expensive,
// which is what a password-based key derivation needs to resist attack.
SecretKey deriveStrong(char[] password, byte[] salt)
throws NoSuchAlgorithmException, InvalidKeySpecException {
PBEKeySpec spec = new PBEKeySpec(password, salt, 100000, 256); // ok: 100,000 iterations
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
return factory.generateSecret(spec);
}
}
To reproduce this example, analyze it with the following configuration:
JAVA_ANALYSIS_ENTRY_POINTS_MODE = ALL_METHODS
Use a safer key derivation function.
The following configuration file parameters affect checks for this warning class.
To report problems with this documentation, please visit https://support.adacore.com/csm.