sc-crypto

SC: Cryptography Misuse

Purpose

Detects cryptographic implementation errors including use of weak algorithms (MD5, SHA1 for security), insecure cipher modes (ECB), static or hardcoded initialization vectors, missing authentication (AES-CBC without HMAC), weak pseudo-random number generators for security purposes, insufficient key lengths, and disabled certificate validation.

Activation

Called by sc-orchestrator during Phase 2. Always runs.

Phase 1: Discovery

Keyword Patterns to Search

# Weak algorithms
"MD5", "md5", "SHA1", "sha1", "DES", "3DES", "RC4", "RC2",
"Blowfish", "IDEA"

# Cipher modes
"ECB", "CBC", "AES/ECB", "AES/CBC", "Mode.ECB"

# Initialization vectors
"iv =", "IV =", "nonce =", "static.*iv", "hardcoded.*iv",
"bytes(16)", "b'\\x00' * 16"

# Weak PRNG
"Math.random(", "random.random(", "random.randint(",
"rand()", "srand(", "java.util.Random", "System.Random"

# Key management
"key =", "encryption_key", "secret_key",
"AES.new(", "Cipher.getInstance(", "crypto.createCipheriv("

# TLS/SSL
"verify=False", "verify_ssl=False", "rejectUnauthorized: false",
"InsecureSkipVerify", "TLSv1", "SSLv3",
"CERT_NONE", "CERT_OPTIONAL"

Vulnerability Patterns

1. Weak Hash for Security:

# VULNERABLE: MD5 for password hashing
password_hash = hashlib.md5(password.encode()).hexdigest()

# VULNERABLE: SHA1 for signature verification
signature = hashlib.sha1(data.encode()).hexdigest()

# SAFE: SHA-256+ for signatures, bcrypt/argon2 for passwords
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())
signature = hashlib.sha256(data.encode()).hexdigest()

2. ECB Mode:

// VULNERABLE: ECB mode reveals patterns in encrypted data
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");

// SAFE: GCM mode (authenticated encryption)
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");

3. Static IV:

// VULNERABLE: Hardcoded IV
const iv = Buffer.from('0000000000000000');
const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);

// SAFE: Random IV per encryption
const iv = crypto.randomBytes(16);
const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);