From 0bcdb91639f5433b2a2f2b64c52b64f02b14b134 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 8 Oct 2025 14:10:54 +0100 Subject: [PATCH] Improve qhelp for broken crypto algo queries Previously it focussed too much on the risk of data being decrypted, and didn't explain why using weak algorithms is a problem in other contexts. --- .../CWE/CWE-327/BrokenCryptoAlgorithm.qhelp | 12 ++++-- .../CWE/CWE-327/BrokenCryptoAlgorithm.qhelp | 12 ++++-- .../CWE-327/BrokenCryptoAlgorithm.qhelp | 29 ++++++++++++--- .../CWE-327/BrokenCryptoAlgorithm.qhelp | 30 ++++++++++++--- .../cwe-327/BrokenCryptoAlgorithm.qhelp | 30 ++++++++++++--- .../CWE-327/BrokenCryptoAlgorithm.qhelp | 37 ++++++++++++++----- 6 files changed, 114 insertions(+), 36 deletions(-) diff --git a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp index 0fcbd89d892..33561b3d1bf 100644 --- a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,11 +3,15 @@ "qhelp.dtd"> -

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

+

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

-

Many cryptographic algorithms provided by cryptography libraries are known to be weak, or -flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted -data.

+

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example: +

+
    +
  • If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.
    • +
  • If a weak hashing algorithm is used to protect data integrity, an attacker may be able to craft a malicious input that has the same hash as a benign one.
    • +
  • If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users.
    • +
 diff --git a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp index 1d8e8db6798..35b37b9f814 100644 --- a/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,11 +3,15 @@ "qhelp.dtd"> -

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

+

Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.

-

Many cryptographic algorithms provided by cryptography libraries are known to be weak, or -flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted -data.

+

Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example: +

+
    +
  • If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.
    • +
  • If a weak hashing algorithm is used to protect data integrity, an attacker may be able to craft a malicious input that has the same hash as a benign one.
    • +
  • If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users.
    • +
 diff --git a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp index e0ccf71572f..bdd1071b613 100644 --- a/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -4,17 +4,34 @@

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example:

+
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak hashing algorithm is used to protect data integrity, an + attacker may be able to craft a malicious input that has the same + hash as a benign one. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +
+ diff --git a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp index a457db90431..003849b17cc 100644 --- a/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/python/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,18 +3,36 @@ "qhelp.dtd"> +

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example:

+
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak hashing algorithm is used to protect data integrity, an + attacker may be able to craft a malicious input that has the same + hash as a benign one. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +
+

This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash diff --git a/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp b/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp index 3346d3f7015..3c4dae2ae7b 100644 --- a/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp +++ b/ruby/ql/src/queries/security/cwe-327/BrokenCryptoAlgorithm.qhelp @@ -4,15 +4,33 @@

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. + Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity.

+

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. + Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example:

+ +
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak hashing algorithm is used to protect data integrity, an + attacker may be able to craft a malicious input that has the same + hash as a benign one. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +

This query alerts on any use of a weak cryptographic algorithm that is not a hashing algorithm. Use of broken or weak cryptographic hash diff --git a/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp b/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp index 7bc1eb018e2..89aa8f71a58 100644 --- a/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp +++ b/rust/ql/src/queries/security/CWE-327/BrokenCryptoAlgorithm.qhelp @@ -3,17 +3,34 @@ "qhelp.dtd"> -

- Using broken or weak cryptographic algorithms can leave data - vulnerable to being decrypted or forged by an attacker. -

+

+ Using broken or weak cryptographic algorithms may compromise + security guarantees such as confidentiality, integrity, and + authenticity. +

-

- Many cryptographic algorithms provided by cryptography - libraries are known to be weak, or flawed. Using such an - algorithm means that encrypted or hashed data is less - secure than it appears to be. -

+

+ Many cryptographic algorithms are known to be weak or flawed. The + security guarantees of a system often rely on the underlying + cryptography, so using a weak algorithm can have severe consequences. + For example: +

+ +
    +
  • + If a weak encryption algorithm is used, an attacker may be able to + decrypt sensitive data. +
    • +
  • + If a weak hashing algorithm is used to protect data integrity, an + attacker may be able to craft a malicious input that has the same + hash as a benign one. +
    • +
  • + If a weak algorithm is used for digital signatures, an attacker may + be able to forge signatures and impersonate legitimate users. +
    • +

This query alerts on any use of a weak cryptographic algorithm that is