Skip to content

Commit cbe37c4

Browse files
ESS-ENNESS-ENN
authored
insecure-cipher-algorithm-rc4-python (#21)
1 parent 72e144d commit cbe37c4

File tree

3 files changed

+161
-0
lines changed

3 files changed

+161
-0
lines changed

‎rules/python/security/insecure-cipher-algorithm-rc4-python.yml

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
severity: warning
3+
language: python
4+
message: >-
5+
Detected ARC4 cipher algorithm which is considered insecure. This
6+
algorithm is not cryptographically secure and can be reversed easily. Use
7+
secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block
8+
cipher such as AES with a block size of 128 bits. When using a block
9+
cipher, use a modern mode of operation that also provides authentication,
10+
such as GCM.
11+
note: >-
12+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
13+
[REFERENCES]
14+
- https://cwe.mitre.org/data/definitions/326.html
15+
- https://www.pycryptodome.org/src/cipher/cipher
16+
utils:
17+
MATCH_PATTERN_arc4.new:
18+
kind: call
19+
all:
20+
- has:
21+
stopBy: end
22+
kind: attribute
23+
all:
24+
- has:
25+
stopBy: neighbor
26+
kind: identifier
27+
pattern: $X
28+
- has:
29+
stopBy: neighbor
30+
kind: identifier
31+
regex: "^new$"
32+
- has:
33+
stopBy: neighbor
34+
kind: argument_list
35+
has:
36+
stopBy: neighbor
37+
kind: identifier
38+
- inside:
39+
stopBy: end
40+
kind: expression_statement
41+
follows:
42+
stopBy: end
43+
kind: import_from_statement
44+
all:
45+
- has:
46+
stopBy: neighbor
47+
kind: dotted_name
48+
all:
49+
- has:
50+
stopBy: neighbor
51+
kind: identifier
52+
regex: "^Crypto$|^Cryptodome$"
53+
- has:
54+
stopBy: neighbor
55+
kind: identifier
56+
regex: "^Cipher$"
57+
- has:
58+
stopBy: neighbor
59+
kind: aliased_import
60+
all:
61+
- has:
62+
stopBy: neighbor
63+
kind: dotted_name
64+
has:
65+
stopBy: neighbor
66+
kind: identifier
67+
regex: "^ARC4$"
68+
- has:
69+
stopBy: neighbor
70+
kind: identifier
71+
pattern: $X
72+
73+
rule:
74+
kind: call
75+
matches: MATCH_PATTERN_arc4.new

‎tests/__snapshots__/insecure-cipher-algorithm-rc4-python-snapshot.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
snapshots:
3+
? "from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4\nfrom Crypto.Cipher import ARC4 as pycrypto_arc4\nkey = b'Very long and confidential key'\nnonce = Random.new().read(16)\ntempkey = SHA.new(key+nonce).digest()\ncipher = pycrypto_arc4.new(tempkey)\nmsg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL') \ncipher = pycryptodomex_arc4.new(tempkey)\nmsg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL')\n"
4+
: labels:
5+
- source: pycrypto_arc4.new(tempkey)
6+
style: primary
7+
start: 222
8+
end: 248
9+
- source: pycrypto_arc4
10+
style: secondary
11+
start: 222
12+
end: 235
13+
- source: new
14+
style: secondary
15+
start: 236
16+
end: 239
17+
- source: pycrypto_arc4.new
18+
style: secondary
19+
start: 222
20+
end: 239
21+
- source: tempkey
22+
style: secondary
23+
start: 240
24+
end: 247
25+
- source: (tempkey)
26+
style: secondary
27+
start: 239
28+
end: 248
29+
- source: Crypto
30+
style: secondary
31+
start: 62
32+
end: 68
33+
- source: Cipher
34+
style: secondary
35+
start: 69
36+
end: 75
37+
- source: Crypto.Cipher
38+
style: secondary
39+
start: 62
40+
end: 75
41+
- source: ARC4
42+
style: secondary
43+
start: 83
44+
end: 87
45+
- source: ARC4
46+
style: secondary
47+
start: 83
48+
end: 87
49+
- source: pycrypto_arc4
50+
style: secondary
51+
start: 91
52+
end: 104
53+
- source: ARC4 as pycrypto_arc4
54+
style: secondary
55+
start: 83
56+
end: 104
57+
- source: from Crypto.Cipher import ARC4 as pycrypto_arc4
58+
style: secondary
59+
start: 57
60+
end: 104
61+
- source: cipher = pycrypto_arc4.new(tempkey)
62+
style: secondary
63+
start: 213
64+
end: 248

‎tests/python/insecure-cipher-algorithm-rc4-python-test.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: insecure-cipher-algorithm-rc4-python
2+
valid:
3+
- |
4+
cipher = AES.new(key, AES.MODE_EAX, nonce=nonce)
5+
plaintext = cipher.decrypt(ciphertext)
6+
try:
7+
cipher.verify(tag)
8+
print("The message is authentic:", plaintext)
9+
except ValueError:
10+
print("Key incorrect or message corrupted")
11+
12+
invalid:
13+
- |
14+
from Cryptodome.Cipher import ARC4 as pycryptodomex_arc4
15+
from Crypto.Cipher import ARC4 as pycrypto_arc4
16+
key = b'Very long and confidential key'
17+
nonce = Random.new().read(16)
18+
tempkey = SHA.new(key+nonce).digest()
19+
cipher = pycrypto_arc4.new(tempkey)
20+
msg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL')
21+
cipher = pycryptodomex_arc4.new(tempkey)
22+
msg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL')

0 commit comments

Comments
 (0)