Use of a broken or weak cryptographic hash algorithm

ID

vbnet.cryptography.weak_hash_algorithm

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Cryptography

Language

VB.NET

Description

Use of a broken or weak cryptographic hash algorithm (MD5, SHA-1, RIPEMD-160 or an HMAC built on them). These algorithms are vulnerable to collision and other attacks and must not be used in security-sensitive contexts. Use SHA-256, SHA-384, SHA-512, SHA-3 or an HMAC based on them instead.

Rationale

Use of a broken or weak cryptographic hash algorithm (MD5, SHA-1, RIPEMD-160 or an HMAC built on them). These algorithms are vulnerable to collision and other attacks and must not be used in security-sensitive contexts. Use SHA-256, SHA-384, SHA-512, SHA-3 or an HMAC based on them instead.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub UseFactories()
    ' VULNERABLE: Use of a broken or weak cryptographic hash algorithm
    Dim m = MD5.Create()
    ' VULNERABLE: Use of a broken or weak cryptographic hash algorithm
    Dim mq = System.Security.Cryptography.MD5.Create()
    ' VULNERABLE: Use of a broken or weak cryptographic hash algorithm
    Dim s = SHA1.Create()

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References