Using non-standard cryptographic algorithms is security-sensitive

The use of a non-standard algorithm is dangerous because a determined attacker may be able to break the algorithm and compromise whatever data has been protected. Standard algorithms like SHA-256, SHA-384, SHA-512, ... should be used instead.

This rule tracks creation of java.security.MessageDigest subclasses.

Recommended Secure Coding Practices

• use a standard algorithm instead of creating a custom one.

Noncompliant Code Example

MyCryptographicAlgorithm extends MessageDigest {
  ...
}

See

• OWASP Top 10 2017 Category A3 - Sensitive Data Exposure
• CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
• SANS Top 25 - Porous Defenses
• Derived from FindSecBugs rule MessageDigest is Custom