Uploaded image for project: 'Rules Repository'
  1. Rules Repository
  2. RSPEC-2278

Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

    XMLWordPrintable

    Details

    • Message:
      Use the recommended AES (Advanced Encryption Standard) instead.
    • Default Severity:
      Blocker
    • Impact:
      High
    • Likelihood:
      High
    • Covered Languages:
      C#, Java, PHP, PL/SQL, Swift
    • Remediation Function:
      Constant/Issue
    • Constant Cost:
      20min
    • Analysis Scope:
      Main Sources
    • Common Rule:
      Yes
    • CERT:
      MSC61-J.
    • CWE:
      CWE-326, CWE-327
    • OWASP:
      A6
    • SANS Top 25:
      Porous Defenses
    • Fortify:
      weak_encryption

      Description

      According to the US National Institute of Standards and Technology (NIST), the Data Encryption Standard (DES) is no longer considered secure:

      Adopted in 1977 for federal agencies to use in protecting sensitive, unclassified information, the DES is being withdrawn because it no longer provides the security that is needed to protect federal government information.
      Federal agencies are encouraged to use the Advanced Encryption Standard, a faster and stronger algorithm approved as FIPS 197 in 2001.

      For similar reasons, RC2 should also be avoided.

      Noncompliant Code Example

      Cipher c = Cipher.getInstance("DESede/ECB/PKCS5Padding");

      Compliant Solution

      Cipher c = Cipher.getInstance("AES/GCM/NoPadding");

      See

        Attachments

          Issue Links

          is implemented by

          New Feature - A new feature of the product, which has yet to be developed. SONARSWIFT-381 Rule S2278: Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. CPP-2022 Rule S2278: Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

          • Major - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. SONARPHP-794 Rule S2278: Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

          • Major - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. SONARPLSQL-699 Rule S2278: Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. SONARJAVA-1210 S2278 should react to properties default value

          • Major - Major loss of function.
          • Closed
          is related to

          New Feature - A new feature of the product, which has yet to be developed. CPP-2320 Rule S5547: Cipher algorithms should be robust

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. SONARJAVA-3737 Improve rules relying on String literals to support identifier from a final or effectively final variable.

          • Major - Major loss of function.
          • Closed
          is superceded by

          Vulnerability Detection - RSPEC-5547 Cipher algorithms should be robust

          • Active
          relates to

          Security Hotspot Detection - RSPEC-4787 Encrypting data is security-sensitive

          • Deprecated
          links to

          Web Link is implemented by sonar-csharp/issues/150

          Web Link is implemented by SonarJS/issues/996

          1.
          		 C# RSPEC-3134 Language-Specification Deprecated Unassigned
          2.
          		 PHP RSPEC-4689 Language-Specification Deprecated Unassigned
          3.
          		 Python RSPEC-4690 Language-Specification Active Unassigned
          4.
          		 C-Family RSPEC-4694 Language-Specification Active Unassigned
          5.
          		 Swift RSPEC-4800 Language-Specification Active Unassigned
          6.
          		 PL/SQL RSPEC-4953 Language-Specification Active Unassigned

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              freddy.mallet Freddy Mallet (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated: