Skip to content

Commit c5cf0ff

Browse files
unprovableunprovable
committed
added java cryptographic check queries
1 parent a359a24 commit c5cf0ff

File tree

10 files changed

+228
-0
lines changed

10 files changed

+228
-0
lines changed

‎java/ql/src/experimental/quantum/Analysis/InsecureNonceGeneration.ql‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* @name Insecure nonce at a cipher operation
3+
* @id java/quantum/insecure-nonce
4+
* @description A nonce is generated from a source that is not secure. This can lead to
5+
* vulnerabilities such as replay attacks or key recovery.
6+
* @kind problem
7+
* @problem.severity error
8+
* @security.severity low
9+
* @precision high
10+
* @tags quantum
11+
* experimental
12+
*/
13+
14+
import experimental.quantum.Language
15+
16+
predicate isInsecureNonceSource(Crypto::NonceArtifactNode n, Crypto::NodeBase src) {
17+
src = n.getSourceNode() and
18+
not src.asElement() instanceof SecureRandomnessInstance
19+
}
20+
21+
from Crypto::KeyOperationNode op, Crypto::NodeBase src
22+
where isInsecureNonceSource(op.getANonce(), src)
23+
select op, "Operation uses insecure nonce source $@", src, src.toString()

‎java/ql/src/experimental/quantum/Analysis/NonAESGCMCipher.ql‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name Cipher not AES-GCM mode
3+
* @id java/quantum/non-aes-gcm
4+
* @description An AES cipher is in use without GCM
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import experimental.quantum.Language
14+
15+
class NonAESGCMAlgorithmNode extends Crypto::KeyOperationAlgorithmNode {
16+
NonAESGCMAlgorithmNode() {
17+
this.getAlgorithmType() = Crypto::KeyOpAlg::TSymmetricCipher(Crypto::KeyOpAlg::AES()) and
18+
this.getModeOfOperation().getModeType() != Crypto::KeyOpAlg::GCM()
19+
}
20+
}
21+
22+
from Crypto::KeyOperationNode op, Crypto::KeyOperationOutputNode codeNode
23+
where op.getAKnownAlgorithm() instanceof NonAESGCMAlgorithmNode and
24+
codeNode = op.getAnOutputArtifact()
25+
select op, "Non-AES-GCM instance."

‎java/ql/src/experimental/quantum/Analysis/NonceReuse.ql‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* @name Reuse of cryptographic nonce
3+
* @description Reuse of nonce in cryptographic operations can lead to vulnerabilities.
4+
* @id java/quantum/reused-nonce
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision medium
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import java
14+
import ArtifactReuse
15+
16+
from Crypto::NonceArtifactNode nonce1, Crypto::NonceArtifactNode nonce2
17+
where isArtifactReuse(nonce1, nonce2)
18+
select nonce1, "Reuse with nonce $@", nonce2, nonce2.toString()

‎java/ql/src/experimental/quantum/Analysis/WeakAsymmetric.ql‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name Weak Asymetric Key Size
3+
* @id java/quantum/weak-asymmetric-key-size
4+
* @description An asymmetric cipher with a short key size is in use
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import java
14+
import experimental.quantum.Language
15+
16+
from Crypto::KeyOperationAlgorithmNode op, DataFlow::Node configSrc, int keySize, string algName
17+
where
18+
keySize = op.getKeySizeFixed() and
19+
keySize < 2048 and
20+
algName = op.getAlgorithmName() and
21+
// Can't be an elliptic curve
22+
not Crypto::isEllipticCurveAlgorithmName(algName)
23+
select op,
24+
"Use of weak asymmetric key size (int bits)" + keySize.toString() + " for algorithm " +
25+
algName.toString() + " at config source $@", configSrc, configSrc.toString()

‎java/ql/src/experimental/quantum/Analysis/WeakBlockModes.ql‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* @name Weak AES Block mode
3+
* @id java/quantum/weak-block-modes
4+
* @description An AES cipher is in use with an insecure block mode
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import java
14+
import experimental.quantum.Language
15+
16+
class WeakAESBlockModeAlgNode extends Crypto::KeyOperationAlgorithmNode {
17+
WeakAESBlockModeAlgNode() {
18+
this.getAlgorithmType() = Crypto::KeyOpAlg::TSymmetricCipher(Crypto::KeyOpAlg::AES()) and
19+
(this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::ECB() or
20+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::CFB() or
21+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::OFB() or
22+
this.getModeOfOperation().getModeType() = Crypto::KeyOpAlg::CTR()
23+
)
24+
}
25+
}
26+
27+
from Crypto::KeyOperationNode op, Crypto::KeyOperationOutputNode codeNode
28+
where op.getAKnownAlgorithm() instanceof WeakAESBlockModeAlgNode and
29+
codeNode = op.getAnOutputArtifact()
30+
select op, "Weak AES block mode instance."

‎java/ql/src/experimental/quantum/Analysis/WeakHashing.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Weak hashes
3+
* @description Finds uses of cryptographic hashing algorithms that are unapproved or otherwise weak.
4+
* @id java/quantum/slices/weak-hashes
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags external/cwe/cwe-327
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::HashAlgorithmNode alg, string name, string msg
16+
where
17+
name = alg.getAlgorithmName() and
18+
not name in ["SHA256", "SHA384", "SHA512", "SHA-256", "SHA-384", "SHA-512"] and
19+
msg = "Use of unapproved hash algorithm or API " + name + "."
20+
select alg, msg

‎java/ql/src/experimental/quantum/Analysis/WeakKDFIterationCount.ql‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* @name Weak known key derivation function iteration count
3+
* @description Detects key derivation operations with a known weak iteration count.
4+
* @id java/quantum/weak-kdf-iteration-count
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import java
14+
import experimental.quantum.Language
15+
16+
from Crypto::KeyDerivationOperationNode op, Literal l
17+
where
18+
op.getIterationCount().asElement() = l and
19+
l.getValue().toInt() < 100000
20+
select op, "Key derivation operation configures iteration count below 100k: $@", l,
21+
l.getValue().toString()

‎java/ql/src/experimental/quantum/Analysis/WeakKDFKeySize.ql‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* @name Weak known key derivation function output length
3+
* @description Detects key derivation operations with a known weak output length
4+
* @id java/quantum/weak-kdf-iteration-count
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import java
14+
import experimental.quantum.Language
15+
16+
from Crypto::KeyDerivationOperationNode op, Literal l
17+
where
18+
op.getOutputKeySize().asElement() = l and
19+
l.getValue().toInt() < 256
20+
select op, "Key derivation operation configures output key length below 256: $@", l,
21+
l.getValue().toString()

‎java/ql/src/experimental/quantum/Analysis/WeakRSA.ql‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* @name Cipher is Weak RSA Implementation
3+
* @id java/quantum/weak-rsa
4+
* @description RSA with a key length <2048 found
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags quantum
10+
* experimental
11+
*/
12+
13+
import experimental.quantum.Language
14+
15+
class WeakRSAAlgorithmNode extends Crypto::KeyOperationAlgorithmNode {
16+
WeakRSAAlgorithmNode() {
17+
this.getAlgorithmType() = Crypto::KeyOpAlg::TAsymmetricCipher(Crypto::KeyOpAlg::RSA()) and
18+
this.getKeySizeFixed() < 2048
19+
}
20+
}
21+
22+
from Crypto::KeyOperationNode op, string message
23+
where op.getAKnownAlgorithm() instanceof WeakRSAAlgorithmNode and
24+
message = "Weak RSA instance found with key length <2048"
25+
select op, message

‎java/ql/src/experimental/quantum/Analysis/WeakSymmetricCiphers.ql‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Weak symmetric ciphers
3+
* @description Finds uses of cryptographic symmetric cipher algorithms that are unapproved or otherwise weak.
4+
* @id java/quantum/slices/weak-ciphers
5+
* @kind problem
6+
* @problem.severity error
7+
* @security.severity low
8+
* @precision high
9+
* @tags external/cwe/cwe-327
10+
*/
11+
12+
import java
13+
import experimental.quantum.Language
14+
15+
from Crypto::KeyOperationAlgorithmNode alg, string name, string msg
16+
where
17+
name = alg.getAlgorithmName() and
18+
name in ["DES", "TripleDES", "DoubleDES", "RC2", "RC4", "IDEA", "Blowfish"] and
19+
msg = "Use of unapproved symmetric cipher algorithm or API: " + name + "."
20+
select alg, msg

0 commit comments

Comments
 (0)