Skip to content

Commit bddd738

Browse files
luchua-bcluchua-bc
committed
Add more cases and change EC to 256 bits
1 parent b3c0e44 commit bddd738

File tree

3 files changed

+50
-16
lines changed

3 files changed

+50
-16
lines changed

‎java/ql/src/experimental/Security/CWE/CWE-326/InsufficientKeySize.ql‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ int getECKeySize(string algorithm) {
4040
or
4141
algorithm.matches("X9.62%") and //specification such as "X9.62 prime192v2"
4242
result = algorithm.regexpCapture("X9\\.62 .*[a-zA-Z](\\d+)[a-zA-Z].*", 1).toInt()
43+
or
44+
(algorithm.matches("prime%") or algorithm.matches("c2tnb%")) and //specification such as "prime192v2"
45+
result = algorithm.regexpCapture(".*[a-zA-Z](\\d+)[a-zA-Z].*", 1).toInt()
4346
}
4447

4548
/** Taint configuration tracking flow from a key generator to a `init` method call. */
@@ -102,7 +105,7 @@ predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
102105
JavaSecurityKeyPairGenerator jpg, KeyPairGeneratorInitConfiguration kc,
103106
DataFlow::PathNode source, DataFlow::PathNode dest
104107
|
105-
jpg.getAlgoSpec().(StringLiteral).getValue() = type and
108+
jpg.getAlgoSpec().(StringLiteral).getValue().toUpperCase() = type and
106109
source.getNode().asExpr() = jpg and
107110
dest.getNode().asExpr() = ma.getQualifier() and
108111
kc.hasFlowPath(source, dest)
@@ -113,7 +116,7 @@ predicate hasShortAsymmetricKeyPair(MethodAccess ma, string msg, string type) {
113116

114117
/** Holds if a DSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
115118
predicate hasShortDSAKeyPair(MethodAccess ma, string msg) {
116-
hasShortAsymmetricKeyPair(ma, msg, "DSA")
119+
hasShortAsymmetricKeyPair(ma, msg, "DSA") or hasShortAsymmetricKeyPair(ma, msg, "DH")
117120
}
118121

119122
/** Holds if a RSA `KeyPairGenerator` initialized by `ma` uses an insufficient key size. `msg` provides a human-readable description of the problem. */
@@ -134,9 +137,9 @@ predicate hasShortECKeyPair(MethodAccess ma, string msg) {
134137
kc.hasFlowPath(source, dest) and
135138
DataFlow::localExprFlow(cie, ma.getArgument(0)) and
136139
ma.getArgument(0).getType() instanceof ECGenParameterSpec and
137-
getECKeySize(cie.getArgument(0).(StringLiteral).getRepresentedString()) < 224
140+
getECKeySize(cie.getArgument(0).(StringLiteral).getRepresentedString()) < 256
138141
) and
139-
msg = "Key size should be at least 224 bits for EC encryption."
142+
msg = "Key size should be at least 256 bits for EC encryption."
140143
}
141144

142145
from Expr e, string msg

‎java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.expected‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
| InsufficientKeySize.java:9:9:9:24 | init(...) | Key size should be at least 128 bits for AES encryption. |
22
| InsufficientKeySize.java:17:9:17:36 | initialize(...) | Key size should be at least 2048 bits for RSA encryption. |
33
| InsufficientKeySize.java:25:9:25:36 | initialize(...) | Key size should be at least 2048 bits for DSA encryption. |
4-
| InsufficientKeySize.java:34:9:34:39 | initialize(...) | Key size should be at least 224 bits for EC encryption. |
5-
| InsufficientKeySize.java:38:9:38:67 | initialize(...) | Key size should be at least 224 bits for EC encryption. |
6-
| InsufficientKeySize.java:48:9:48:39 | initialize(...) | Key size should be at least 224 bits for EC encryption. |
7-
| InsufficientKeySize.java:53:9:53:39 | initialize(...) | Key size should be at least 224 bits for EC encryption. |
8-
| InsufficientKeySize.java:58:9:58:40 | initialize(...) | Key size should be at least 224 bits for EC encryption. |
4+
| InsufficientKeySize.java:34:9:34:39 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
5+
| InsufficientKeySize.java:38:9:38:67 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
6+
| InsufficientKeySize.java:48:9:48:39 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
7+
| InsufficientKeySize.java:53:9:53:39 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
8+
| InsufficientKeySize.java:58:9:58:40 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
9+
| InsufficientKeySize.java:68:9:68:40 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
10+
| InsufficientKeySize.java:78:9:78:40 | initialize(...) | Key size should be at least 256 bits for EC encryption. |
11+
| InsufficientKeySize.java:87:9:87:37 | initialize(...) | Key size should be at least 2048 bits for DH encryption. |

‎java/ql/test/experimental/query-tests/security/CWE-326/InsufficientKeySize.java‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,37 +29,65 @@ public void CryptoMethod() {
2929
keyPairGen4.initialize(2048);
3030

3131
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("EC");
32-
// BAD: Key size is less than 224
32+
// BAD: Key size is less than 256
3333
ECGenParameterSpec ecSpec1 = new ECGenParameterSpec("secp112r1");
3434
keyPairGen5.initialize(ecSpec1);
3535

3636
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("EC");
37-
// BAD: Key size is less than 224
37+
// BAD: Key size is less than 256
3838
keyPairGen6.initialize(new ECGenParameterSpec("secp112r1"));
3939

4040
KeyPairGenerator keyPairGen7 = KeyPairGenerator.getInstance("EC");
41-
// GOOD: Key size is no less than 224
41+
// GOOD: Key size is no less than 256
4242
ECGenParameterSpec ecSpec2 = new ECGenParameterSpec("secp256r1");
4343
keyPairGen7.initialize(ecSpec2);
4444

4545
KeyPairGenerator keyPairGen8 = KeyPairGenerator.getInstance("EC");
46-
// BAD: Key size is less than 224
46+
// BAD: Key size is less than 256
4747
ECGenParameterSpec ecSpec3 = new ECGenParameterSpec("X9.62 prime192v2");
4848
keyPairGen8.initialize(ecSpec3);
4949

5050
KeyPairGenerator keyPairGen9 = KeyPairGenerator.getInstance("EC");
51-
// BAD: Key size is less than 224
51+
// BAD: Key size is less than 256
5252
ECGenParameterSpec ecSpec4 = new ECGenParameterSpec("X9.62 c2tnb191v3");
5353
keyPairGen9.initialize(ecSpec4);
5454

5555
KeyPairGenerator keyPairGen10 = KeyPairGenerator.getInstance("EC");
56-
// BAD: Key size is less than 224
56+
// BAD: Key size is less than 256
5757
ECGenParameterSpec ecSpec5 = new ECGenParameterSpec("sect163k1");
5858
keyPairGen10.initialize(ecSpec5);
5959

6060
KeyPairGenerator keyPairGen11 = KeyPairGenerator.getInstance("EC");
61-
// GOOD: Key size is no less than 224
61+
// GOOD: Key size is no less than 256
6262
ECGenParameterSpec ecSpec6 = new ECGenParameterSpec("X9.62 c2tnb359v1");
6363
keyPairGen11.initialize(ecSpec6);
64+
65+
KeyPairGenerator keyPairGen12 = KeyPairGenerator.getInstance("EC");
66+
// BAD: Key size is less than 256
67+
ECGenParameterSpec ecSpec7 = new ECGenParameterSpec("prime192v2");
68+
keyPairGen12.initialize(ecSpec7);
69+
70+
KeyPairGenerator keyPairGen13 = KeyPairGenerator.getInstance("EC");
71+
// BAD: Key size is no less than 256
72+
ECGenParameterSpec ecSpec8 = new ECGenParameterSpec("prime256v1");
73+
keyPairGen13.initialize(ecSpec8);
74+
75+
KeyPairGenerator keyPairGen14 = KeyPairGenerator.getInstance("EC");
76+
// BAD: Key size is less than 256
77+
ECGenParameterSpec ecSpec9 = new ECGenParameterSpec("c2tnb191v1");
78+
keyPairGen14.initialize(ecSpec9);
79+
80+
KeyPairGenerator keyPairGen15 = KeyPairGenerator.getInstance("EC");
81+
// BAD: Key size is no less than 256
82+
ECGenParameterSpec ecSpec10 = new ECGenParameterSpec("c2tnb431r1");
83+
keyPairGen15.initialize(ecSpec10);
84+
85+
KeyPairGenerator keyPairGen16 = KeyPairGenerator.getInstance("dh");
86+
// BAD: Key size is less than 2048
87+
keyPairGen16.initialize(1024);
88+
89+
KeyPairGenerator keyPairGen17 = KeyPairGenerator.getInstance("DH");
90+
// GOOD: Key size is no less than 2048
91+
keyPairGen17.initialize(2048);
6492
}
6593
}

0 commit comments

Comments
 (0)