Avoid using the insecure DES or 3DES ciphers

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST Rules > Avoid using the insecure DES or 3DES ciphers

Metadata

ID: rust-security/avoid-des

Language: Rust

Severity: Warning

Category: Security

CWE: 327

Related CWEs:

Description

DES uses a 56-bit key that can be brute-forced in hours on modern hardware. Triple DES (3DES) is deprecated by NIST SP 800-131A and remains vulnerable to Sweet32 birthday attacks against its 64-bit block size. Use AES-256-GCM (via the aes-gcm crate) or another modern authenticated encryption algorithm instead.

Learn More

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Non-Compliant Code Examples

use des;
use des::Des;
use des::{Des, TdesEde3};
use openssl::symm::Cipher;

fn invalid() {
    let key = [0u8; 8];

    // RustCrypto `des` crate — single DES and Triple DES variants
    let _ = des::Des::new_from_slice(&key);
    let _ = des::TdesEde3::new_from_slice(&key);

    // openssl/boring `Cipher::des_*()` builders
    let _ = Cipher::des_cbc();
    let _ = openssl::symm::Cipher::des_ede3_cbc();
}

Compliant Code Examples

use aes_gcm::{Aes256Gcm, KeyInit};

fn ok() {
    // Safe: AES-256-GCM instead of DES
    let key = [0u8; 32];
    let _ = Aes256Gcm::new(&key.into());
}