Add more encryption algorithms and modes to CryptoAlgorithms::AlgorithmNames

alexrford · alexrford · commit d3af68776798 · 2021-12-22T16:38:15.000Z
Strong encryption algorithms: ARIA, IDEA, SEED, SM4
Strong block modes: CBC, CFB, CTR, OFB
diff --git a/javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll b/javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll
@@ -14,10 +14,9 @@
  * The classification into strong and weak are based on Wikipedia, OWASP and google (2017).
  */
 module AlgorithmNames {
-  predicate isStrongBlockMode(string name) { name = ["CCM", "GCM"] }
-
-  predicate isWeakBlockMode(string name) { name = "ECB" }
-
+  /**
+   * Holds if `name` corresponds to a strong hashing algorithm.
+   */
   predicate isStrongHashingAlgorithm(string name) {
     name =
       [
@@ -26,6 +25,9 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak hashing algorithm.
+   */
   predicate isWeakHashingAlgorithm(string name) {
     name =
       [
@@ -34,16 +36,22 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong encryption algorithm.
+   */
   predicate isStrongEncryptionAlgorithm(string name) {
     name =
       [
         "AES", "AES128", "AES192", "AES256", "AES512", "AES-128", "AES-192", "AES-256", "AES-512",
-        "RSA", "RABBIT", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
+        "ARIA", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
         "CAMELLIA192", "CAMELLIA256", "CAMELLIA-128", "CAMELLIA-192", "CAMELLIA-256", "CHACHA",
-        "GOST", "GOST89"
+        "GOST", "GOST89", "IDEA", "RABBIT", "RSA", "SEED", "SM4"
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak encryption algorithm.
+   */
   predicate isWeakEncryptionAlgorithm(string name) {
     name =
       [
@@ -52,11 +60,27 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong password hashing algorithm.
+   */
   predicate isStrongPasswordHashingAlgorithm(string name) {
     name = ["ARGON2", "PBKDF2", "BCRYPT", "SCRYPT"]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak password hashing algorithm.
+   */
   predicate isWeakPasswordHashingAlgorithm(string name) { name = "EVPKDF" }
+
+  /**
+   * Holds if `name` corresponds to a strong block cipher mode of operation.
+   */
+  predicate isStrongBlockMode(string name) { name = ["CBC", "CCM", "CFB", "CTR", "GCM", "OFB"] }
+
+  /**
+   * Holds if `name` corresponds to a weak block cipher mode of operation.
+   */
+  predicate isWeakBlockMode(string name) { name = "ECB" }
 }
 
 private import AlgorithmNames
diff --git a/python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll b/python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll
@@ -14,10 +14,9 @@
  * The classification into strong and weak are based on Wikipedia, OWASP and google (2017).
  */
 module AlgorithmNames {
-  predicate isStrongBlockMode(string name) { name = ["CCM", "GCM"] }
-
-  predicate isWeakBlockMode(string name) { name = "ECB" }
-
+  /**
+   * Holds if `name` corresponds to a strong hashing algorithm.
+   */
   predicate isStrongHashingAlgorithm(string name) {
     name =
       [
@@ -26,6 +25,9 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak hashing algorithm.
+   */
   predicate isWeakHashingAlgorithm(string name) {
     name =
       [
@@ -34,16 +36,22 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong encryption algorithm.
+   */
   predicate isStrongEncryptionAlgorithm(string name) {
     name =
       [
         "AES", "AES128", "AES192", "AES256", "AES512", "AES-128", "AES-192", "AES-256", "AES-512",
-        "RSA", "RABBIT", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
+        "ARIA", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
         "CAMELLIA192", "CAMELLIA256", "CAMELLIA-128", "CAMELLIA-192", "CAMELLIA-256", "CHACHA",
-        "GOST", "GOST89"
+        "GOST", "GOST89", "IDEA", "RABBIT", "RSA", "SEED", "SM4"
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak encryption algorithm.
+   */
   predicate isWeakEncryptionAlgorithm(string name) {
     name =
       [
@@ -52,11 +60,27 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong password hashing algorithm.
+   */
   predicate isStrongPasswordHashingAlgorithm(string name) {
     name = ["ARGON2", "PBKDF2", "BCRYPT", "SCRYPT"]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak password hashing algorithm.
+   */
   predicate isWeakPasswordHashingAlgorithm(string name) { name = "EVPKDF" }
+
+  /**
+   * Holds if `name` corresponds to a strong block cipher mode of operation.
+   */
+  predicate isStrongBlockMode(string name) { name = ["CBC", "CCM", "CFB", "CTR", "GCM", "OFB"] }
+
+  /**
+   * Holds if `name` corresponds to a weak block cipher mode of operation.
+   */
+  predicate isWeakBlockMode(string name) { name = "ECB" }
 }
 
 private import AlgorithmNames
diff --git a/ruby/ql/lib/codeql/ruby/security/CryptoAlgorithms.qll b/ruby/ql/lib/codeql/ruby/security/CryptoAlgorithms.qll
@@ -14,10 +14,9 @@
  * The classification into strong and weak are based on Wikipedia, OWASP and google (2017).
  */
 module AlgorithmNames {
-  predicate isStrongBlockMode(string name) { name = ["CCM", "GCM"] }
-
-  predicate isWeakBlockMode(string name) { name = "ECB" }
-
+  /**
+   * Holds if `name` corresponds to a strong hashing algorithm.
+   */
   predicate isStrongHashingAlgorithm(string name) {
     name =
       [
@@ -26,6 +25,9 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak hashing algorithm.
+   */
   predicate isWeakHashingAlgorithm(string name) {
     name =
       [
@@ -34,16 +36,22 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong encryption algorithm.
+   */
   predicate isStrongEncryptionAlgorithm(string name) {
     name =
       [
         "AES", "AES128", "AES192", "AES256", "AES512", "AES-128", "AES-192", "AES-256", "AES-512",
-        "RSA", "RABBIT", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
+        "ARIA", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",
         "CAMELLIA192", "CAMELLIA256", "CAMELLIA-128", "CAMELLIA-192", "CAMELLIA-256", "CHACHA",
-        "GOST", "GOST89"
+        "GOST", "GOST89", "IDEA", "RABBIT", "RSA", "SEED", "SM4"
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak encryption algorithm.
+   */
   predicate isWeakEncryptionAlgorithm(string name) {
     name =
       [
@@ -52,11 +60,27 @@ module AlgorithmNames {
       ]
   }
 
+  /**
+   * Holds if `name` corresponds to a strong password hashing algorithm.
+   */
   predicate isStrongPasswordHashingAlgorithm(string name) {
     name = ["ARGON2", "PBKDF2", "BCRYPT", "SCRYPT"]
   }
 
+  /**
+   * Holds if `name` corresponds to a weak password hashing algorithm.
+   */
   predicate isWeakPasswordHashingAlgorithm(string name) { name = "EVPKDF" }
+
+  /**
+   * Holds if `name` corresponds to a strong block cipher mode of operation.
+   */
+  predicate isStrongBlockMode(string name) { name = ["CBC", "CCM", "CFB", "CTR", "GCM", "OFB"] }
+
+  /**
+   * Holds if `name` corresponds to a weak block cipher mode of operation.
+   */
+  predicate isWeakBlockMode(string name) { name = "ECB" }
 }
 
 private import AlgorithmNames

Original file line number	Diff line number	Diff line change
`@@ -14,10 +14,9 @@`
`14`	`14`	`* The classification into strong and weak are based on Wikipedia, OWASP and google (2017).`
`15`	`15`	`*/`
`16`	`16`	`module AlgorithmNames {`
`17`		`- predicate isStrongBlockMode(string name) { name = ["CCM", "GCM"] }`
`18`		`-`
`19`		`- predicate isWeakBlockMode(string name) { name = "ECB" }`
`20`		`-`
	`17`	`+ /**`
	`18`	+ * Holds if `name` corresponds to a strong hashing algorithm.
	`19`	`+ */`
`21`	`20`	`predicate isStrongHashingAlgorithm(string name) {`
`22`	`21`	`name =`
`23`	`22`	`[`
`@@ -26,6 +25,9 @@ module AlgorithmNames {`
`26`	`25`	`]`
`27`	`26`	`}`
`28`	`27`
	`28`	`+ /**`
	`29`	+ * Holds if `name` corresponds to a weak hashing algorithm.
	`30`	`+ */`
`29`	`31`	`predicate isWeakHashingAlgorithm(string name) {`
`30`	`32`	`name =`
`31`	`33`	`[`
`@@ -34,16 +36,22 @@ module AlgorithmNames {`
`34`	`36`	`]`
`35`	`37`	`}`
`36`	`38`
	`39`	`+ /**`
	`40`	+ * Holds if `name` corresponds to a strong encryption algorithm.
	`41`	`+ */`
`37`	`42`	`predicate isStrongEncryptionAlgorithm(string name) {`
`38`	`43`	`name =`
`39`	`44`	`[`
`40`	`45`	`"AES", "AES128", "AES192", "AES256", "AES512", "AES-128", "AES-192", "AES-256", "AES-512",`
`41`		`- "RSA", "RABBIT", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",`
	`46`	`+ "ARIA", "BLOWFISH", "BF", "ECIES", "CAST", "CAST5", "CAMELLIA", "CAMELLIA128",`
`42`	`47`	`"CAMELLIA192", "CAMELLIA256", "CAMELLIA-128", "CAMELLIA-192", "CAMELLIA-256", "CHACHA",`
`43`		`- "GOST", "GOST89"`
	`48`	`+ "GOST", "GOST89", "IDEA", "RABBIT", "RSA", "SEED", "SM4"`
`44`	`49`	`]`
`45`	`50`	`}`
`46`	`51`
	`52`	`+ /**`
	`53`	+ * Holds if `name` corresponds to a weak encryption algorithm.
	`54`	`+ */`
`47`	`55`	`predicate isWeakEncryptionAlgorithm(string name) {`
`48`	`56`	`name =`
`49`	`57`	`[`
`@@ -52,11 +60,27 @@ module AlgorithmNames {`
`52`	`60`	`]`
`53`	`61`	`}`
`54`	`62`
	`63`	`+ /**`
	`64`	+ * Holds if `name` corresponds to a strong password hashing algorithm.
	`65`	`+ */`
`55`	`66`	`predicate isStrongPasswordHashingAlgorithm(string name) {`
`56`	`67`	`name = ["ARGON2", "PBKDF2", "BCRYPT", "SCRYPT"]`
`57`	`68`	`}`
`58`	`69`
	`70`	`+ /**`
	`71`	+ * Holds if `name` corresponds to a weak password hashing algorithm.
	`72`	`+ */`
`59`	`73`	`predicate isWeakPasswordHashingAlgorithm(string name) { name = "EVPKDF" }`
	`74`	`+`
	`75`	`+ /**`
	`76`	+ * Holds if `name` corresponds to a strong block cipher mode of operation.
	`77`	`+ */`
	`78`	`+ predicate isStrongBlockMode(string name) { name = ["CBC", "CCM", "CFB", "CTR", "GCM", "OFB"] }`
	`79`	`+`
	`80`	`+ /**`
	`81`	+ * Holds if `name` corresponds to a weak block cipher mode of operation.
	`82`	`+ */`
	`83`	`+ predicate isWeakBlockMode(string name) { name = "ECB" }`
`60`	`84`	`}`
`61`	`85`
`62`	`86`	`private import AlgorithmNames`