Use of a Broken or Risky Cryptographic Algorithm
ID |
scala.cryptography.scala_crypto_rule_custommessagedigest |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
Scala |
Description
Implementing a custom MessageDigest is error-prone. National Institute of Standards and Technology(NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or SHA-512/256.
Rationale
Implementing a custom MessageDigest is error-prone. National Institute of Standards and Technology(NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or SHA-512/256.
The following code illustrates a vulnerable pattern detected by this rule:
// A hand-rolled digest: the bytes are collected and the first eight returned.
// VULNERABLE: Use of a Broken or Risky Cryptographic Algorithm
class TruncatingDigest extends MessageDigest("TRUNC8") {
private val collected = new ByteArrayOutputStream
override protected def engineUpdate(b: Byte): Unit = {
collected.write(b)
}
override protected def engineUpdate(block: Array[Byte], from: Int, length: Int): Unit = {
try collected.write(block)
catch {
case e: IOException =>
throw new RuntimeException(e)
}
}
override protected def engineDigest = {
val all = collected.toByteArray
Arrays.copyOf(all, 8)
}
override protected def engineReset(): Unit = {
collected.reset
}
}
Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.