Skip to content

Fix CWE-327 (Weak Cryptography) — automated red/blue remediation #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
codegm2020 wants to merge 14 commits into
base: master
Choose a base branch
from
Open

Fix CWE-327 (Weak Cryptography) — automated red/blue remediation #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
0214c7f
fix(CWE-327): BenchmarkTest00005 — Weak Cryptography (red-verified, r…
Sep 24, 2026
a2d9d9f
fix(CWE-327): BenchmarkTest00019 — Weak Cryptography (red-verified, r…
Sep 24, 2026
3f1906d
fix(CWE-327): BenchmarkTest00020 — Weak Cryptography (red-verified, r…
Sep 24, 2026
cae7506
fix(CWE-327): BenchmarkTest00035 — Weak Cryptography (red-verified, r…
Sep 24, 2026
91703e2
fix(CWE-327): BenchmarkTest00050 — Weak Cryptography (red-verified, r…
Sep 24, 2026
8e68de9
fix(CWE-327): BenchmarkTest00053 — Weak Cryptography (red-verified, r…
Sep 24, 2026
d3026be
fix(CWE-327): BenchmarkTest00055 — Weak Cryptography (red-verified, r…
Sep 24, 2026
aa02ab1
fix(CWE-327): BenchmarkTest00056 — Weak Cryptography (red-verified, r…
Sep 24, 2026
91d2072
fix(CWE-327): BenchmarkTest00057 — Weak Cryptography (red-verified, r…
Sep 24, 2026
abaf56c
fix(CWE-327): BenchmarkTest00119 — Weak Cryptography (red-verified, r…
Sep 24, 2026
7654b66
fix(CWE-327): BenchmarkTest00120 — Weak Cryptography (red-verified, r…
Sep 24, 2026
2e53012
fix(CWE-327): BenchmarkTest00123 — Weak Cryptography (red-verified, r…
Sep 24, 2026
199e2e7
fix(CWE-327): BenchmarkTest00124 — Weak Cryptography (red-verified, r…
Sep 24, 2026
35ed003
fix(CWE-327): BenchmarkTest00125 — Weak Cryptography (red-verified, r…
Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00005.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,12 +60,18 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys

try {
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding");

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM requires 12 byte IV
byte[] ivGCM = new byte[12];
java.security.SecureRandom randomGCM = new java.security.SecureRandom();
randomGCM.nextBytes(ivGCM);
javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, ivGCM);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
14 changes: 11 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00019.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,12 +47,20 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
java.util.Properties benchmarkprops = new java.util.Properties();
benchmarkprops.load(
this.getClass().getClassLoader().getResourceAsStream("benchmark.properties"));
String algorithm = benchmarkprops.getProperty("cryptoAlg1", "DESede/ECB/PKCS5Padding");
String algorithm = "AES/GCM/NoPadding";
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance(algorithm);

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // 128-bit AES key
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM requires an IV (nonce)
byte[] iv = new byte[12]; // 12 bytes for GCM nonce
java.security.SecureRandom random = new java.security.SecureRandom();
random.nextBytes(iv);
javax.crypto.spec.GCMParameterSpec spec = new javax.crypto.spec.GCMParameterSpec(128, iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, spec);

// encrypt and store the results
byte[] input = {(byte) '?'};
Expand Down
8 changes: 5 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00020.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,11 +56,13 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)

try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE");
javax.crypto.Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");
// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
// GCM requires 12 byte IV
byte[] iv = random.generateSeed(12);
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
new javax.crypto.spec.GCMParameterSpec(128, iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
10 changes: 7 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00035.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,12 +62,16 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
java.util.Properties benchmarkprops = new java.util.Properties();
benchmarkprops.load(
this.getClass().getClassLoader().getResourceAsStream("benchmark.properties"));
String algorithm = benchmarkprops.getProperty("cryptoAlg1", "DESede/ECB/PKCS5Padding");
String algorithm = "AES/GCM/NoPadding";
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance(algorithm);

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

javax.crypto.spec.GCMParameterSpec gcmSpec = new javax.crypto.spec.GCMParameterSpec(128, new byte[12]); // 12-byte zero IV for example
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, gcmSpec);

// encrypt and store the results
byte[] input = {(byte) '?'};
Expand Down
9 changes: 5 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00050.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,11 +57,12 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)

try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE");
javax.crypto.Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");
// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
byte[] iv = random.generateSeed(12); // GCM recommended 12 bytes IV
javax.crypto.spec.GCMParameterSpec paramSpec =
new javax.crypto.spec.GCMParameterSpec(128, iv); // 128 bit authentication tag
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
14 changes: 11 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00053.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,12 +83,20 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance(
"DES/CBC/PKCS5PADDING", java.security.Security.getProvider("SunJCE"));
"AES/GCM/NoPadding", java.security.Security.getProvider("SunJCE"));

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM requires 12 byte IV
byte[] ivGCM = new byte[12];
java.security.SecureRandom randomGCM = new java.security.SecureRandom();
randomGCM.nextBytes(ivGCM);

java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
new javax.crypto.spec.GCMParameterSpec(128, ivGCM);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
9 changes: 6 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00055.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)

try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE");
javax.crypto.Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");
// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
byte[] iv = new byte[12]; // 12 bytes IV for GCM
java.security.SecureRandom random = new java.security.SecureRandom();
random.nextBytes(iv);
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
new javax.crypto.spec.GCMParameterSpec(128, iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
9 changes: 6 additions & 3 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00056.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,11 +87,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)

try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE");
javax.crypto.Cipher.getInstance("AES/GCM/NoPadding", "SunJCE");
// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
byte[] iv = new byte[12]; // 12 bytes IV for GCM
java.security.SecureRandom random = new java.security.SecureRandom();
random.nextBytes(iv);
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
new javax.crypto.spec.GCMParameterSpec(128, iv); // 128 bit auth tag length
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
14 changes: 10 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00057.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,12 +81,18 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys

try {
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding");

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM requires 12 byte IV
byte[] ivGCM = new byte[12];
java.security.SecureRandom randomGCM = new java.security.SecureRandom();
randomGCM.nextBytes(ivGCM);
javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, ivGCM);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
9 changes: 5 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00119.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,17 +78,18 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
// (byte)0x44, (byte)0x21, (byte)0xC3, (byte)0xC3033
// };
java.security.SecureRandom random = new java.security.SecureRandom();
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys
byte[] iv = new byte[12]; // 12 bytes for GCM nonce
random.nextBytes(iv);

try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance(
"DES/CBC/PKCS5PADDING", java.security.Security.getProvider("SunJCE"));
"AES/GCM/NoPadding", java.security.Security.getProvider("SunJCE"));

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
new javax.crypto.spec.GCMParameterSpec(128, iv); // 128-bit auth tag length
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
11 changes: 7 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00120.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,12 +67,15 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
try {
javax.crypto.Cipher c =
javax.crypto.Cipher.getInstance(
"DES/CBC/PKCS5PADDING", java.security.Security.getProvider("SunJCE"));
"AES/GCM/NoPadding", java.security.Security.getProvider("SunJCE"));

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES").generateKey();

// GCM standard nonce length is 12 bytes
byte[] ivGCM = new byte[12];
new java.security.SecureRandom().nextBytes(ivGCM);
javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, ivGCM);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
16 changes: 11 additions & 5 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00123.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,13 +61,19 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys

try {
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding");

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("AES");
key.init(128); // AES key size
javax.crypto.SecretKey secretKey = key.generateKey();

// GCM recommended 12 bytes IV
byte[] ivGCM = new byte[12];
java.security.SecureRandom randomGCM = new java.security.SecureRandom();
randomGCM.nextBytes(ivGCM);
javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, ivGCM);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, secretKey, paramSpec);

// encrypt and store the results
byte[] input = {(byte) '?'};
Expand Down
15 changes: 11 additions & 4 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00124.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,12 +66,19 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys

try {
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding");

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM recommended 12 bytes IV
java.security.SecureRandom random = new java.security.SecureRandom();
byte[] iv = new byte[12];
random.nextBytes(iv);

javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
Expand Down
17 changes: 12 additions & 5 deletions src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00125.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,18 +61,25 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
byte[] iv = random.generateSeed(8); // DES requires 8 byte keys

try {
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding");
javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES/GCM/NoPadding");

// Prepare the cipher to encrypt
javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey();
java.security.spec.AlgorithmParameterSpec paramSpec =
new javax.crypto.spec.IvParameterSpec(iv);
javax.crypto.KeyGenerator keyGen = javax.crypto.KeyGenerator.getInstance("AES");
keyGen.init(128); // AES key size
javax.crypto.SecretKey key = keyGen.generateKey();

// GCM recommended 12 bytes IV
byte[] iv = new byte[12];
java.security.SecureRandom random = new java.security.SecureRandom();
random.nextBytes(iv);

javax.crypto.spec.GCMParameterSpec paramSpec = new javax.crypto.spec.GCMParameterSpec(128, iv);
c.init(javax.crypto.Cipher.ENCRYPT_MODE, key, paramSpec);

// encrypt and store the results
byte[] input = {(byte) '?'};
Object inputParam = bar;
if (inputParam instanceof String) input = ((String) inputParam).getBytes();
if (inputParam instanceof String) input = ((String) inputParam).getBytes(java.nio.charset.StandardCharsets.UTF_8);
if (inputParam instanceof java.io.InputStream) {
byte[] strInput = new byte[1000];
int i = ((java.io.InputStream) inputParam).read(strInput);
Expand Down