hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improve qhelp for broken crypto algo queries

Browse Source 
Previously it focussed too much on the risk of data being decrypted,
and didn't explain why using weak algorithms is a problem in other
contexts.
This commit is contained in:
Owen Mansel-Chan
2025-10-08 14:10:54 +01:00
parent 2a1c9d8ec1
commit 0bcdb91639
6 changed files with 114 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp
View File

@@ -3,11 +3,15 @@
"qhelp.dtd">
<qhelp>
<overview>
<p>Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.</p>
<p>Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.</p>
<p>Many cryptographic algorithms provided by cryptography libraries are known to be weak, or
flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted
data.</p>
<p>Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:
</p>
<ul>
<li>If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.</li>
<li>If a weak hashing algorithm is used to protect data integrity, an attacker may be able to craft a malicious input that has the same hash as a benign one.</li>
<li>If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users.</li>
</ul>
</overview>
<recommendation>