Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5ab5e75

Browse files
tamasvajktamasvajk
authored
Merge pull request #4255 from fatenhealy/IncreaseInsufficientKeySizeValue
Increase insufficient key size value from 1024 to 2048
2 parents 475519c + a89d13a commit 5ab5e75

6 files changed

Lines changed: 18 additions & 18 deletions

File tree

‎change-notes/1.26/analysis-csharp.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ The following changes in version 1.26 affect C# analysis in all applications.
1212

1313
| **Query** | **Expected impact** | **Change** |
1414
|------------------------------|------------------------|-----------------------------------|
15-
15+
| Weak encryption: Insufficient key size (`cs/insufficient-key-size`) | More results | The required key size has been increased from 1024 to 2048. |
1616

1717
## Removal of old queries
1818

‎csharp/ql/src/Security Features/InsufficientKeySize.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ static public byte[] EncryptWithRSA(byte[] plaintext, RSAParameters key)
1111
{
1212
try
1313
{
14-
RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(512); // BAD
14+
RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(1024); // BAD
1515
rsa.ImportParameters(key);
1616
return rsa.Encrypt(plaintext, true);
1717
}
@@ -27,7 +27,7 @@ static public byte[] EncryptWithRSA2(byte[] plaintext, RSAParameters key)
2727
try
2828
{
2929
RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(); // BAD
30-
rsa = new RSACryptoServiceProvider(1024); // GOOD
30+
rsa = new RSACryptoServiceProvider(2048); // GOOD
3131
rsa.ImportParameters(key);
3232
return rsa.Encrypt(plaintext, true);
3333
}
@@ -58,7 +58,7 @@ static public byte[] EncryptWithDSA2(byte[] plaintext, DSAParameters key)
5858
try
5959
{
6060
DSACryptoServiceProvider dsa = new DSACryptoServiceProvider(); // BAD
61-
dsa = new DSACryptoServiceProvider(1024); // GOOD
61+
dsa = new DSACryptoServiceProvider(2048); // GOOD
6262
dsa.ImportParameters(key);
6363
return dsa.SignData(plaintext);
6464
}
@@ -121,7 +121,7 @@ public static byte[] DSASignHash(byte[] HashToSign, DSAParameters DSAKeyInfo,
121121
try
122122
{
123123
// Create a new instance of DSACryptoServiceProvider.
124-
using (DSACryptoServiceProvider DSA = new DSACryptoServiceProvider(1024)) // GOOD
124+
using (DSACryptoServiceProvider DSA = new DSACryptoServiceProvider(2048)) // GOOD
125125
{
126126
// Import the key information.
127127
DSA.ImportParameters(DSAKeyInfo);

‎csharp/ql/src/Security Features/InsufficientKeySize.qhelp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ are vulnerable to brute force attack when too small a key size is used.</p>
88

99
</overview>
1010
<recommendation>
11-
<p>The key should be at least 1024-bit long when using RSA encryption, and 128-bit long when using
11+
<p>The key should be at least 2048-bit long when using RSA encryption, and 128-bit long when using
1212
symmetric encryption.</p>
1313

1414
</recommendation>

‎csharp/ql/src/Security Features/InsufficientKeySize.ql‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,17 +29,17 @@ predicate incorrectUseOfDSA(ObjectCreation e, string msg) {
2929
.getTarget()
3030
.getDeclaringType()
3131
.hasQualifiedName("System.Security.Cryptography", "DSACryptoServiceProvider") and
32-
exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 1024) and
33-
msg = "Key size should be at least 1024 bits for DSA encryption."
32+
exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 2048) and
33+
msg = "Key size should be at least 2048 bits for DSA encryption."
3434
}
3535

3636
predicate incorrectUseOfRSA(ObjectCreation e, string msg) {
3737
e
3838
.getTarget()
3939
.getDeclaringType()
4040
.hasQualifiedName("System.Security.Cryptography", "RSACryptoServiceProvider") and
41-
exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 1024) and
42-
msg = "Key size should be at least 1024 bits for RSA encryption."
41+
exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 2048) and
42+
msg = "Key size should be at least 2048 bits for RSA encryption."
4343
}
4444

4545
from Expr e, string msg

‎csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ public void CryptoMethod()
1313
// GOOD: Key size is greater than 128
1414
new RC2CryptoServiceProvider().EffectiveKeySize = 256;
1515

16-
// BAD: Key size is less than 1024.
16+
// BAD: Key size is less than 2048.
1717
DSACryptoServiceProvider dsaBad = new DSACryptoServiceProvider(512);
18-
// GOOD: Key size defaults to 1024.
18+
// GOOD: Key size defaults to 2048.
1919
DSACryptoServiceProvider dsaGood1 = new DSACryptoServiceProvider();
20-
// GOOD: Key size is greater than 1024.
20+
// GOOD: Key size is greater than 2048.
2121
DSACryptoServiceProvider dsaGood2 = new DSACryptoServiceProvider(2048);
2222

23-
// BAD: Key size is less than 1024.
23+
// BAD: Key size is less than 2048.
2424
RSACryptoServiceProvider rsaBad = new RSACryptoServiceProvider(512);
25-
// GOOD: Key size defaults to 1024.
25+
// GOOD: Key size defaults to 2048.
2626
RSACryptoServiceProvider rsaGood1 = new RSACryptoServiceProvider();
27-
// GOOD: Key size is greater than 1024.
27+
// GOOD: Key size is greater than 2048.
2828
RSACryptoServiceProvider rsaGood2 = new RSACryptoServiceProvider(2048);
2929
}
3030
}

‎csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.expected‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
| InsufficientKeySize.cs:10:9:10:60 | ... = ... | Key size should be at least 128 bits for RC2 encryption. |
2-
| InsufficientKeySize.cs:17:43:17:75 | object creation of type DSACryptoServiceProvider | Key size should be at least 1024 bits for DSA encryption. |
3-
| InsufficientKeySize.cs:24:43:24:75 | object creation of type RSACryptoServiceProvider | Key size should be at least 1024 bits for RSA encryption. |
2+
| InsufficientKeySize.cs:17:43:17:75 | object creation of type DSACryptoServiceProvider | Key size should be at least 2048 bits for DSA encryption. |
3+
| InsufficientKeySize.cs:24:43:24:75 | object creation of type RSACryptoServiceProvider | Key size should be at least 2048 bits for RSA encryption. |

0 commit comments

Comments
 (0)