Skip to content

Commit 83ff70b

Browse files
bdrodesbdrodes
committed
Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.
1 parent bd34b6c commit 83ff70b

File tree

5 files changed

+241
-5
lines changed

5 files changed

+241
-5
lines changed

‎java/ql/lib/experimental/quantum/Language.qll‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,9 @@ private class GenericRemoteDataSource extends Crypto::GenericRemoteDataSource {
9393
override string getAdditionalDescription() { result = this.toString() }
9494
}
9595

96-
private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
97-
ConstantDataSource() {
96+
private class ConstantDataSourceLiteral extends Crypto::GenericConstantSourceInstance instanceof Literal
97+
{
98+
ConstantDataSourceLiteral() {
9899
// TODO: this is an API specific workaround for JCA, as 'EC' is a constant that may be used
99100
// where typical algorithms are specified, but EC specifically means set up a
100101
// default curve container, that will later be specified explicitly (or if not a default)
@@ -112,6 +113,20 @@ private class ConstantDataSource extends Crypto::GenericConstantSourceInstance i
112113
override string getAdditionalDescription() { result = this.toString() }
113114
}
114115

116+
private class ConstantDataSourceArrayInitializer extends Crypto::GenericConstantSourceInstance instanceof ArrayInit
117+
{
118+
ConstantDataSourceArrayInitializer() { exists(Literal l | this.getAnInit() = l) }
119+
120+
override DataFlow::Node getOutputNode() { result.asExpr() = this }
121+
122+
override predicate flowsTo(Crypto::FlowAwareElement other) {
123+
// TODO: separate config to avoid blowing up data-flow analysis
124+
GenericDataSourceFlow::flow(this.getOutputNode(), other.getInputNode())
125+
}
126+
127+
override string getAdditionalDescription() { result = this.toString() }
128+
}
129+
115130
/**
116131
* An instance of random number generation, modeled as the expression
117132
* tied to an output node (i.e., the result of the source of randomness)

‎java/ql/src/experimental/quantum/Analysis/InsecureIVorNonceSource.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
2-
* @name Insecure nonce (static value or weak random source)
2+
* @name Insecure nonce/iv (static value or weak random source)
33
* @id java/quantum/insecure-iv-or-nonce
4-
* @description A nonce is generated from a source that is not secure. This can lead to
4+
* @description A nonce/iv is generated from a source that is not secure. This can lead to
55
* vulnerabilities such as replay attacks or key recovery.
66
* @kind problem
77
* @problem.severity error
@@ -16,4 +16,4 @@ from Crypto::NonceArtifactNode nonce, Crypto::NodeBase src
1616
where
1717
nonce.getSourceNode() = src and
1818
not src.asElement() instanceof SecureRandomnessInstance
19-
select nonce, "Nonce or IV uses insecure nonce source $@", src, src.toString()
19+
select nonce, "Nonce or IV uses insecure or constant source $@", src, src.toString()

‎java/ql/test/experimental/query-tests/quantum/InsecureNonceSource/InsecureIVorNonceSource.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
| InsecureIVorNonceSource.java:20:51:20:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:14:21:14:81 | Constant | Constant |
2+
| InsecureIVorNonceSource.java:49:51:49:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:42:21:42:21 | Constant | Constant |
3+
| InsecureIVorNonceSource.java:65:51:65:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:57:13:57:62 | Constant | Constant |
4+
| InsecureIVorNonceSource.java:65:51:65:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:58:13:58:63 | Constant | Constant |
5+
| InsecureIVorNonceSource.java:81:51:81:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:73:13:73:73 | Constant | Constant |
6+
| InsecureIVorNonceSource.java:81:51:81:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:74:13:74:74 | Constant | Constant |
7+
| InsecureIVorNonceSource.java:206:51:206:56 | Nonce | Nonce or IV uses insecure or constant source $@ | InsecureIVorNonceSource.java:194:26:194:30 | RandomNumberGeneration | RandomNumberGeneration |

‎java/ql/test/experimental/query-tests/quantum/InsecureNonceSource/InsecureIVorNonceSource.java‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
import javax.crypto.Cipher;
2+
import javax.crypto.spec.GCMParameterSpec;
3+
import javax.crypto.spec.IvParameterSpec;
4+
import javax.crypto.spec.SecretKeySpec;
5+
import java.util.Random;
6+
7+
import java.security.SecureRandom;
8+
import java.util.Arrays;
9+
10+
public class InsecureIVorNonceSource {
11+
12+
// BAD: AES-GCM with static IV from a byte array
13+
public byte[] encryptWithStaticIvByteArrayWithInitializer(byte[] key, byte[] plaintext) throws Exception {
14+
byte[] iv = new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 }; // $Source
15+
16+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
17+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
18+
19+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
20+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
21+
cipher.update(plaintext);
22+
return cipher.doFinal();
23+
}
24+
25+
// BAD: AES-GCM with static IV from zero-initialized byte array
26+
public byte[] encryptWithZeroStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
27+
byte[] iv = new byte[16]; // $Source
28+
29+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
30+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
31+
32+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
33+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/unknown-iv-or-nonce-initialization]
34+
cipher.update(plaintext);
35+
return cipher.doFinal();
36+
}
37+
38+
// BAD: AES-CBC with static IV from 1-initialized byte array
39+
public byte[] encryptWithStaticIvByteArray(byte[] key, byte[] plaintext) throws Exception {
40+
byte[] iv = new byte[16]; // $Source
41+
for (byte i = 0; i < iv.length; i++) {
42+
iv[i] = 1;
43+
}
44+
45+
IvParameterSpec ivSpec = new IvParameterSpec(iv);
46+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
47+
48+
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
49+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
50+
cipher.update(plaintext);
51+
return cipher.doFinal();
52+
}
53+
54+
// BAD: AES-GCM with static IV from a multidimensional byte array
55+
public byte[] encryptWithOneOfStaticIvs01(byte[] key, byte[] plaintext) throws Exception {
56+
byte[][] staticIvs = new byte[][] {
57+
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 },
58+
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 }
59+
}; // $Source
60+
61+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
62+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
63+
64+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
65+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
66+
cipher.update(plaintext);
67+
return cipher.doFinal();
68+
}
69+
70+
// BAD: AES-GCM with static IV from a multidimensional byte array
71+
public byte[] encryptWithOneOfStaticIvs02(byte[] key, byte[] plaintext) throws Exception {
72+
byte[][] staticIvs = new byte[][] {
73+
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5 },
74+
new byte[] { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 42 }
75+
}; // $Source
76+
77+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, staticIvs[1]);
78+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
79+
80+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
81+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]
82+
cipher.update(plaintext);
83+
return cipher.doFinal();
84+
}
85+
86+
// BAD: AES-GCM with static IV from a zero-initialized multidimensional byte array
87+
public byte[] encryptWithOneOfStaticZeroIvs(byte[] key, byte[] plaintext) throws Exception {
88+
byte[][] ivs = new byte[][] {
89+
new byte[8], // $Source
90+
new byte[16] // $Source
91+
};
92+
93+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, ivs[1]);
94+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
95+
96+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
97+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/unknown-iv-or-nonce-initialization]
98+
cipher.update(plaintext);
99+
return cipher.doFinal();
100+
}
101+
102+
// GOOD: AES-GCM with a random IV
103+
public byte[] encryptWithRandomIv(byte[] key, byte[] plaintext) throws Exception {
104+
byte[] iv = new byte[16];
105+
106+
SecureRandom random = SecureRandom.getInstanceStrong();
107+
random.nextBytes(iv);
108+
109+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
110+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
111+
112+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
113+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
114+
cipher.update(plaintext);
115+
return cipher.doFinal();
116+
}
117+
118+
// GOOD: AES-GCM with a random IV
119+
public byte[] encryptWithRandomIvByteByByte(byte[] key, byte[] plaintext) throws Exception {
120+
SecureRandom random = SecureRandom.getInstanceStrong();
121+
byte[] iv = new byte[16];
122+
for (int i = 0; i < iv.length; i++) {
123+
iv[i] = (byte) random.nextInt();
124+
}
125+
126+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
127+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
128+
129+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
130+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
131+
cipher.update(plaintext);
132+
return cipher.doFinal();
133+
}
134+
135+
// GOOD: AES-GCM with a random IV
136+
public byte[] encryptWithRandomIvWithSystemArrayCopy(byte[] key, byte[] plaintext) throws Exception {
137+
byte[] randomBytes = new byte[16];
138+
SecureRandom.getInstanceStrong().nextBytes(randomBytes);
139+
140+
byte[] iv = new byte[16];
141+
System.arraycopy(randomBytes, 0, iv, 0, 16);
142+
143+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
144+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
145+
146+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
147+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
148+
cipher.update(plaintext);
149+
return cipher.doFinal();
150+
}
151+
152+
// GOOD: AES-GCM with a random IV
153+
public byte[] encryptWithRandomIvWithArraysCopy(byte[] key, byte[] plaintext) throws Exception {
154+
byte[] randomBytes = new byte[16];
155+
SecureRandom.getInstanceStrong().nextBytes(randomBytes);
156+
157+
byte[] iv = new byte[16];
158+
iv = Arrays.copyOf(randomBytes, 16);
159+
160+
GCMParameterSpec ivSpec = new GCMParameterSpec(128, iv);
161+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
162+
163+
Cipher cipher = Cipher.getInstance("AES/GCM/PKCS5PADDING");
164+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
165+
cipher.update(plaintext);
166+
return cipher.doFinal();
167+
}
168+
169+
public byte[] generate(int size) throws Exception {
170+
if (size == 0) {
171+
return new byte[0];
172+
}
173+
byte[] randomBytes = new byte[size];
174+
SecureRandom.getInstanceStrong().nextBytes(randomBytes);
175+
return randomBytes;
176+
}
177+
178+
// GOOD: AES-CBC with a random IV
179+
public byte[] encryptWithGeneratedIvByteArray(byte[] key, byte[] plaintext) throws Exception {
180+
byte[] iv = generate(16);
181+
182+
IvParameterSpec ivSpec = new IvParameterSpec(iv);
183+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
184+
185+
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
186+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
187+
cipher.update(plaintext);
188+
return cipher.doFinal();
189+
}
190+
191+
public byte[] generateInsecureRandomBytes(int numBytes) {
192+
Random random = new Random();
193+
byte[] bytes = new byte[numBytes];
194+
random.nextBytes(bytes); // $Source
195+
return bytes;
196+
}
197+
198+
// BAD: AES-CBC with an insecure random IV
199+
public byte[] encryptWithGeneratedIvByteArrayInsecure(byte[] key, byte[] plaintext) throws Exception {
200+
byte[] iv = generateInsecureRandomBytes(16);
201+
202+
IvParameterSpec ivSpec = new IvParameterSpec(iv);
203+
SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
204+
205+
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
206+
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec); // $Alert[java/quantum/insecure-iv-or-nonce]]
207+
cipher.update(plaintext);
208+
return cipher.doFinal();
209+
}
210+
}

‎java/ql/test/experimental/query-tests/quantum/InsecureNonceSource/InsecureIVorNonceSource.qlref‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
query: experimental/quantum/Analysis/InsecureIVorNonceSource.ql
2+
postprocess:
3+
- utils/test/PrettyPrintModels.ql
4+
- utils/test/InlineExpectationsTestQuery.ql

0 commit comments

Comments
 (0)