Do not use weak ciphers

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST ルール > Do not use weak ciphers

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: csharp-security/weak-cipher

Language: C#

Severity: Error

Category: Security

CWE: 327

Related CWEs:

Description

The DESCryptoServiceProvider should only be used with legacy code for compatibility reasons. For new code, consider using the Aes class.

Learn More

DESCryptoServiceProvider Class documentation

Non-Compliant Code Examples

class MyClass {
    public static void weakEncryption()
    {
        DES des = new DESCryptoServiceProvider();
        CryptoStream encStream = new CryptoStream(fout, des.CreateEncryptor(desKey, desIV), CryptoStreamMode.Write);

    }
}

Compliant Code Examples

class MyClass {
    public static void strongEncryption()
    {
        // Safe: using AES instead of DES
        using (Aes aes = Aes.Create())
        {
            CryptoStream encStream = new CryptoStream(fout, aes.CreateEncryptor(), CryptoStreamMode.Write);
        }
    }
}