Crypto: Removing non-ascii characters from unit tests

This commit is contained in:
REDMOND\brodes
2025-10-06 09:56:14 -04:00
parent b32a6407b9
commit 606aef38cb
6 changed files with 5 additions and 21 deletions

View File

@@ -24,7 +24,7 @@ import java.util.Base64;
* - Brainpool (e.g., brainpoolP256r1)
* - CURVE25519 (for X25519 key agreement)
* - ES (e.g., Ed25519 for signatures)
* - Other fallback (e.g., secp256r1 for OtherEllipticCurveType)
* - Other fallback (e.g., secp256r1 for "OtherEllipticCurveType")
*
* Best practices:
* - Use ephemeral keys and a strong RNG.

View File

@@ -28,7 +28,7 @@ import java.util.Properties;
* 1. PBKDF2 Examples:
* - Parent Classification: Password-Based Key Derivation Function (PBKDF).
* - SAST:
* * pbkdf2DerivationBasic: Uses PBKDF2WithHmacSHA256 with 10,000 iterations
* * pbkdf2DerivationBasic: Uses PBKDF2WithHmacSHA256 with 10,000 iterations -
* acceptable if parameters meet current standards.
* * pbkdf2LowIteration: Uses only 10 iterations flagged as insecure due to
* insufficient iteration count.

View File

@@ -15,7 +15,7 @@ import java.util.Base64;
/**
* MACOperation demonstrates various Message Authentication Code (MAC)
* operations and further use of MAC outputs as inputs into higherlevel
* operations and further use of MAC outputs as inputs into higher-level
* cryptosystems.
*
* Flows include:

View File

@@ -143,7 +143,7 @@ public class SignEncryptCombinations {
* UNSAFE FLOW: Signs the plaintext and encrypts only the signature.
*
* <p>
* **Issue:** The plaintext message is not encryptedonly the signature is.
* **Issue:** The plaintext message is not encrypted, only the signature is.
* This exposes the original message to eavesdroppers and negates the purpose of
* encryption.
* </p>

View File

@@ -235,22 +235,6 @@ public class SignatureOperation {
System.out.println("Empty message signature verified? " + verified);
}
/**
* Demonstrates signing and verifying data containing non-ASCII characters.
*
* CBOM/SAST Notes:
* - Edge Case: Non-ASCII (e.g., Unicode) data should be handled correctly.
*/
public void signAndVerifyNonAsciiMessage() throws Exception {
// Use a message with Unicode characters.
String nonAscii = "こんにちは世界"; // "Hello World" in Japanese.
byte[] message = nonAscii.getBytes("UTF-8");
KeyPair kp = generateEd25519KeyPair();
byte[] sig = signEd25519(kp.getPrivate(), message);
boolean verified = verifyEd25519(kp.getPublic(), message, sig);
System.out.println("Non-ASCII message signature verified? " + verified);
}
/**
* Demonstrates that even a slight tampering with the signature will cause
* verification to fail.

View File

@@ -81,7 +81,7 @@ public class SymmetricAlgorithm {
*/
public byte[] aesGcmEncryptUnsafe(SecretKey key, byte[] plaintext) throws Exception {
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
byte[] iv = new byte[12]; // Fixed IV (all zeros by default) insecure.
byte[] iv = new byte[12]; // Fixed IV (all zeros by default) - insecure.
GCMParameterSpec spec = new GCMParameterSpec(128, iv);
cipher.init(Cipher.ENCRYPT_MODE, key, spec);
byte[] ciphertext = cipher.doFinal(plaintext);