Use of a broken or deprecated symmetric encryption algorithm

ID

vbnet.cryptography.weak_encryption_algorithm

Severity

critical

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Cryptography

Language

VB.NET

Description

Use of a broken or deprecated symmetric encryption algorithm (DES, RC2, TripleDES/3DES, RC4 or RijndaelManaged). These ciphers are cryptographically weak and must not be used to protect sensitive data. Use a modern authenticated cipher such as AES-GCM (AesGcm) or ChaCha20Poly1305 instead.

Rationale

Use of a broken or deprecated symmetric encryption algorithm (DES, RC2, TripleDES/3DES, RC4 or RijndaelManaged). These ciphers are cryptographically weak and must not be used to protect sensitive data. Use a modern authenticated cipher such as AES-GCM (AesGcm) or ChaCha20Poly1305 instead.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub UseFactories()
    ' VULNERABLE: Use of a broken or deprecated symmetric encryption algorithm
    Dim d = DES.Create()
    ' VULNERABLE: Use of a broken or deprecated symmetric encryption algorithm
    Dim dq = System.Security.Cryptography.DES.Create()
    ' VULNERABLE: Use of a broken or deprecated symmetric encryption algorithm
    Dim r = RC2.Create()
    ' VULNERABLE: Use of a broken or deprecated symmetric encryption algorithm
    Dim t = TripleDES.Create()

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References