RSA key created with an insufficient key size (< 2048 bits)

ID

vbnet.cryptography.insufficient_key_size

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Cryptography

Language

VB.NET

Description

An RSA key is being created with a key size smaller than 2048 bits. Keys of 1024 bits or fewer are considered breakable and no longer provide adequate encryption strength. Use an RSA key size of at least 2048 bits (2048 or 4096).

Rationale

An RSA key is being created with a key size smaller than 2048 bits. Keys of 1024 bits or fewer are considered breakable and no longer provide adequate encryption strength. Use an RSA key size of at least 2048 bits (2048 or 4096).

The following code illustrates a vulnerable pattern detected by this rule:

Sub CreateKeys()

    ' VULNERABLE: RSA key created with an insufficient key size (< 2048 bits)
    Dim rsaWeak As New RSACryptoServiceProvider(512)

    ' VULNERABLE: RSA key created with an insufficient key size (< 2048 bits)
    Dim rsaWeak2 As New RSACryptoServiceProvider(1024)

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References