Use of a cryptographic algorithm with insufficient key size
ID: cpp/insufficient-key-size
Kind: path-problem
Security severity: 7.5
Severity: error
Precision: high
Tags:
- security
- external/cwe/cwe-326
Query suites:
- cpp-code-scanning.qls
- cpp-security-extended.qls
- cpp-security-and-quality.qls
Click to see the query in the CodeQL repository
Using cryptographic algorithms with a small key size can leave data vulnerable to being decrypted.
Many cryptographic algorithms provided by cryptography libraries can be configured with key sizes that are vulnerable to brute force attacks. Using such a key size means that an attacker may be able to easily decrypt the encrypted data.
Recommendation
Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048.
Example
The following code shows an example of using the
openssl
library to generate an RSA key. When creating a key, you must specify which key size to use. The first example uses 1024 bits, which is not considered sufficient. The second example uses 2048 bits, which is currently considered sufficient.
void
encrypt_with_openssl
(
EVP_PKEY_CTX
*
ctx
)
{
// BAD: only 1024 bits for an RSA key
EVP_PKEY_CTX_set_rsa_keygen_bits
(
ctx
,
1024
);
// GOOD: 2048 bits for an RSA key
EVP_PKEY_CTX_set_rsa_keygen_bits
(
ctx
,
2048
);
}
