Use of a Broken or Risky Cryptographic Algorithm

ID

scala.cryptography.scala_crypto_rule_custommessagedigest

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Cryptography

Language

Scala

Description

Implementing a custom MessageDigest is error-prone. National Institute of Standards and Technology(NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or SHA-512/256.

Rationale

Implementing a custom MessageDigest is error-prone. National Institute of Standards and Technology(NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or SHA-512/256.

The following code illustrates a vulnerable pattern detected by this rule:

// A hand-rolled digest: the bytes are collected and the first eight returned.
// VULNERABLE: Use of a Broken or Risky Cryptographic Algorithm
class TruncatingDigest extends MessageDigest("TRUNC8") {
  private val collected = new ByteArrayOutputStream

  override protected def engineUpdate(b: Byte): Unit = {
    collected.write(b)
  }

  override protected def engineUpdate(block: Array[Byte], from: Int, length: Int): Unit = {
    try collected.write(block)
    catch {
      case e: IOException =>
        throw new RuntimeException(e)
    }
  }

  override protected def engineDigest = {
    val all = collected.toByteArray
    Arrays.copyOf(all, 8)
  }

  override protected def engineReset(): Unit = {
    collected.reset
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved