Crypto: Weak asymmetric key gen size fixes and test. · github/codeql@3667365 · GitHub
Skip to content

Commit 3667365

Browse files
bdrodesbdrodes
committed
Crypto: Weak asymmetric key gen size fixes and test.
1 parent 758759a commit 3667365

6 files changed

Lines changed: 58 additions & 24 deletions

File tree

‎java/ql/lib/experimental/quantum/JCA.qll‎

Lines changed: 6 additions & 2 deletions

‎java/ql/src/experimental/quantum/Examples/WeakAsymmetric.ql‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎java/ql/src/experimental/quantum/Examples/WeakAsymmetricKeyGenSize.ql‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name Weak Asymmetric Key Size
3+
* @id java/quantum/weak-asymmetric-key-gen-size
4+
* @description An asymmetric key of known size is less than 2048 bits for any non-elliptic curve key operation.
5+
* @kind problem
6+
* @problem.severity error
7+
* @precision high
8+
* @tags quantum
9+
* experimental
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::KeyArtifactNode key, int keySize, Crypto::AlgorithmNode alg
16+
where
17+
key.getCreatingOperation().getAKeySizeSource().asElement().(Literal).getValue().toInt() = keySize and
18+
alg = key.getAKnownAlgorithm() and // NOTE: if algorithm is not known (doesn't bind) we need a separate query
19+
not alg instanceof Crypto::EllipticCurveNode and // Elliptic curve sizes are handled separately and are more tied directly to the algorithm
20+
keySize < 2048
21+
select key, "Use of weak asymmetric key size (" + keySize.toString() + " bits) for algorithm $@",
22+
alg, alg.getAlgorithmName()

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownAsymmetricKeySize/InsufficientAsymmetricKeySize.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
import java.security.*;
2+
public class InsufficientAsymmetricKeySize{
3+
public static void test() throws Exception{
4+
KeyPairGenerator keyPairGen1 = KeyPairGenerator.getInstance("RSA");
5+
keyPairGen1.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
6+
keyPairGen1.generateKeyPair();
7+
8+
KeyPairGenerator keyPairGen2 = KeyPairGenerator.getInstance("DSA");
9+
keyPairGen2.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
10+
keyPairGen2.generateKeyPair();
11+
12+
KeyPairGenerator keyPairGen3 = KeyPairGenerator.getInstance("DH");
13+
keyPairGen3.initialize(1024); // $Alert[java/quantum/weak-asymmetric-key-gen-size]
14+
keyPairGen3.generateKeyPair();
15+
16+
KeyPairGenerator keyPairGen4 = KeyPairGenerator.getInstance("RSA");
17+
keyPairGen4.initialize(2048); // GOOD
18+
keyPairGen4.generateKeyPair();
19+
20+
KeyPairGenerator keyPairGen5 = KeyPairGenerator.getInstance("DSA");
21+
keyPairGen5.initialize(2048); // GOOD
22+
keyPairGen5.generateKeyPair();
23+
24+
KeyPairGenerator keyPairGen6 = KeyPairGenerator.getInstance("DH");
25+
keyPairGen6.initialize(2048); // GOOD
26+
keyPairGen6.generateKeyPair();
27+
}
28+
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownAsymmetricKeySize/WeakOrUnknownAsymmetricKeyGenSize.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
a

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownAsymmetricKeySize/WeakOrUnknownAsymmetricKeyGenSize.qlref‎

Lines changed: 1 addition & 0 deletions

0 commit comments

Comments
 (0)