Java: Query to detect weak encryption: insufficient key size

[luchua-bc]

Strength of cryptographic algorithms depends on a sufficient key size to be robust against brute-force attacks. A theoretically sound encryption scheme with an insufficient key size can still be subjected to brute force attacks that have a reasonable chance of succeeding using current attack methods and resources.

This type of issues is categorized as CWE-326: Inadequate Encryption Strength.

This query finds uses of strong encryption algorithms (AES, DSA, RSA, and EC) with too small a key size.

Please consider to merge the PR. Thanks.

[smowton]

OK sure that's enough factoring, running tests

[JarLob]

Hey @luchua-bc,

1. OWASP recommends minimum 256 bits for ECDH and ECDSA. Could you please bump the requirement to 256 bits?
2. It looks like algorithms like "prime192v2" can be also specified without the "X9.62 ". Could you please handle these cases too??
3. Please add "c2tnb" family to the list.
4. The algorithm name for KeyPairGenerator.getInstance is not case sensitive.
5. Please add "DH" algorithm name to the "DSA" check.

[luchua-bc]

@JarLob I've made requested changes. Please review. Thanks.

[smowton]

Please rebase. Pinged a codeowner for final review.

[luchua-bc]

Thanks @smowton. I've rebased this branch.

[aschackmull]

Looks mostly good to me. Just a few comments.

[luchua-bc]

Thanks @aschackmull for reviewing this PR. I've made requested text changes.