Avoid DES keys

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST ルール > Avoid DES keys

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: java-security/keygenerator-avoid-des

Language: Java

Severity: Warning

Category: Security

CWE: 327

Related CWEs:

Description

The DES protocol is deprecated. Consider using a stronger protocol such as AES.

Learn More

CWE-326: Inadequate Encryption Strength

Non-Compliant Code Examples

public Class {

    void test1() {
            javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
            java.security.spec.AlgorithmParameterSpec paramSpec =
                    new javax.crypto.spec.IvParameterSpec(iv);
            c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

    }

    void test2() {
            javax.crypto.SecretKey key = KeyGenerator.getInstance("DES").generateKey();
            java.security.spec.AlgorithmParameterSpec paramSpec =
                    new javax.crypto.spec.IvParameterSpec(iv);
            c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

    }
}

Compliant Code Examples

public class SecureKeyGen {
    void generateSecureKey() throws Exception {
        // Safe: using AES instead of DES
        javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
    }
}