Skip to content

Commit 540daa6

Browse files
bdrodesbdrodes
committed
Crypto: weak symmetric cipher tests.
1 parent b06e053 commit 540daa6

File tree

3 files changed

+96
-0
lines changed

3 files changed

+96
-0
lines changed

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownSymmetricCipher/Test.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
import javax.crypto.Cipher;
2+
import javax.crypto.KeyGenerator;
3+
import javax.crypto.SecretKey;
4+
import java.security.Key;
5+
import java.security.NoSuchAlgorithmException;
6+
7+
public class Test {
8+
public static void main(String[] args) throws Exception {
9+
byte[] data = "Sensitive Data".getBytes();
10+
11+
// BAD: DES (unsafe)
12+
KeyGenerator desKeyGen = KeyGenerator.getInstance("DES"); // $Alert
13+
SecretKey desKey = desKeyGen.generateKey();
14+
Cipher desCipher = Cipher.getInstance("DES"); // $Alert
15+
desCipher.init(Cipher.ENCRYPT_MODE, desKey);
16+
byte[] desEncrypted = desCipher.doFinal(data);
17+
18+
// BAD: DESede (Triple DES, considered weak)
19+
KeyGenerator desedeKeyGen = KeyGenerator.getInstance("DESede"); // $Alert
20+
SecretKey desedeKey = desedeKeyGen.generateKey();
21+
Cipher desedeCipher = Cipher.getInstance("DESede"); // $Alert
22+
desedeCipher.init(Cipher.ENCRYPT_MODE, desedeKey);
23+
byte[] desedeEncrypted = desedeCipher.doFinal(data);
24+
25+
// BAD: Blowfish (considered weak)
26+
KeyGenerator blowfishKeyGen = KeyGenerator.getInstance("Blowfish"); // $Alert
27+
SecretKey blowfishKey = blowfishKeyGen.generateKey();
28+
Cipher blowfishCipher = Cipher.getInstance("Blowfish"); // $Alert
29+
blowfishCipher.init(Cipher.ENCRYPT_MODE, blowfishKey);
30+
byte[] blowfishEncrypted = blowfishCipher.doFinal(data);
31+
32+
// BAD: RC2 (unsafe)
33+
KeyGenerator rc2KeyGen = KeyGenerator.getInstance("RC2");
34+
SecretKey rc2Key = rc2KeyGen.generateKey();
35+
Cipher rc2Cipher = Cipher.getInstance("RC2"); // $Alert
36+
rc2Cipher.init(Cipher.ENCRYPT_MODE, rc2Key);
37+
byte[] rc2Encrypted = rc2Cipher.doFinal(data);
38+
39+
// BAD: RC4 (stream cipher, unsafe)
40+
KeyGenerator rc4KeyGen = KeyGenerator.getInstance("RC4"); // $Alert
41+
SecretKey rc4Key = rc4KeyGen.generateKey();
42+
Cipher rc4Cipher = Cipher.getInstance("RC4"); // $Alert
43+
rc4Cipher.init(Cipher.ENCRYPT_MODE, rc4Key);
44+
byte[] rc4Encrypted = rc4Cipher.doFinal(data);
45+
46+
// BAD: IDEA (considered weak)
47+
KeyGenerator ideaKeyGen = KeyGenerator.getInstance("IDEA"); // $Alert
48+
SecretKey ideaKey = ideaKeyGen.generateKey();
49+
Cipher ideaCipher = Cipher.getInstance("IDEA"); // $Alert
50+
ideaCipher.init(Cipher.ENCRYPT_MODE, ideaKey);
51+
byte[] ideaEncrypted = ideaCipher.doFinal(data);
52+
53+
// BAD: Skipjack (unsafe)
54+
KeyGenerator skipjackKeyGen = KeyGenerator.getInstance("Skipjack"); // $Alert
55+
SecretKey skipjackKey = skipjackKeyGen.generateKey();
56+
Cipher skipjackCipher = Cipher.getInstance("Skipjack"); // $Alert
57+
skipjackCipher.init(Cipher.ENCRYPT_MODE, skipjackKey);
58+
byte[] skipjackEncrypted = skipjackCipher.doFinal(data);
59+
60+
// GOOD: AES (safe)
61+
KeyGenerator aesKeyGen = KeyGenerator.getInstance("AES");
62+
SecretKey aesKey = aesKeyGen.generateKey();
63+
Cipher aesCipher = Cipher.getInstance("AES");
64+
aesCipher.init(Cipher.ENCRYPT_MODE, aesKey);
65+
byte[] aesEncrypted = aesCipher.doFinal(data);
66+
67+
// GOOD: AES with CBC mode and PKCS5Padding
68+
Cipher aesCbcCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
69+
aesCbcCipher.init(Cipher.ENCRYPT_MODE, aesKey);
70+
byte[] aesCbcEncrypted = aesCbcCipher.doFinal(data);
71+
72+
// GOOD: AES with GCM mode (authenticated encryption)
73+
Cipher aesGcmCipher = Cipher.getInstance("AES/GCM/NoPadding");
74+
aesGcmCipher.init(Cipher.ENCRYPT_MODE, aesKey);
75+
byte[] aesGcmEncrypted = aesGcmCipher.doFinal(data);
76+
}
77+
}

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownSymmetricCipher/WeakSymmetricCipher.expected‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#select
2+
| Test.java:12:59:12:63 | KeyOperationAlgorithm | Use of unapproved symmetric cipher algorithm or API: DES. |
3+
| Test.java:14:47:14:51 | KeyOperationAlgorithm | Use of unapproved symmetric cipher algorithm or API: DES. |
4+
| Test.java:40:59:40:63 | KeyOperationAlgorithm | Use of unapproved symmetric cipher algorithm or API: RC4. |
5+
| Test.java:42:47:42:51 | KeyOperationAlgorithm | Use of unapproved symmetric cipher algorithm or API: RC4. |
6+
testFailures
7+
| Test.java:19:73:19:82 | // $Alert | Missing result: Alert |
8+
| Test.java:21:61:21:70 | // $Alert | Missing result: Alert |
9+
| Test.java:26:77:26:86 | // $Alert | Missing result: Alert |
10+
| Test.java:28:65:28:74 | // $Alert | Missing result: Alert |
11+
| Test.java:35:55:35:64 | // $Alert | Missing result: Alert |
12+
| Test.java:47:69:47:78 | // $Alert | Missing result: Alert |
13+
| Test.java:49:57:49:66 | // $Alert | Missing result: Alert |
14+
| Test.java:54:77:54:86 | // $Alert | Missing result: Alert |
15+
| Test.java:56:65:56:74 | // $Alert | Missing result: Alert |

‎java/ql/test/experimental/query-tests/quantum/examples/WeakOrUnknownSymmetricCipher/WeakSymmetricCipher.qlref‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: experimental/quantum/Examples/WeakSymmetricCipher.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

0 commit comments

Comments
 (0)