Skip to content

Use of RSA Algorithm without OAEP

Description

The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

Examples

Insecure Code

scala
javax.crypto.Cipher.getInstance("RSA/ECB/NoPadding")

Secure Code

scala
javax.crypto.Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding")

Remediation

Use RSA with OAEP, such as RSA/ECB/OAEPWithSHA-256AndMGF1Padding

Rule Details

FieldValue
IDCODE-0028
CategoryCrypto
SeverityMEDIUM
CWECWE-780
ConfidenceHIGH
ImpactMEDIUM
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagsencryption, cryptographic failures
OWASPA3:2017-Sensitive Data Exposure, A02:2021-Cryptographic Failures