Testing for Weak Encryption (OTG-CRYPST-004)
Incorrect uses of encryption algorithm may result in sensitive data exposure, key leakage, broken authentication, insecure session and spoofing attack. There are some encryption or hash algorithm is known to be weak and not suggested to be used anymore such MD5 and RC4.
In addition to the right choices of secure encryption or hash algorithm, the right uses of parameters also mater the security level. For example, ECB (Electronic Code Book) mode is not suggested to be used in asymmetric encryption.
The testing guide is trying to provide a guideline how to identify the weak encryption and hash.
How to Test
Basic Security Checklist
- The IV (Initialization vector) must be random and unpredictable. Refer to FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. random number generator tests. For example, in Java, "java.util.Random" is considered a weak random number generator. "java.security.SecureRandom" should be used instead of "java.util.Random".
- When uses of RSA in encryption, Optimal Asymmetric Encryption Padding (OAEP) mode is recommended.
- When uses of RSA in signature, PSS padding is recommended.
- Weak hash/encryption algorithms should not be used such MD5, RC4, SHA1.
- Minium Key length requirment:
Key exchange: Diffie–Hellman key exchange with minimum 2048 bits
Message Integrity: HMAC-SHA2
Message Hash: SHA2 256 bits
Assymetric encryption: RSA 2048 bits
Symmetric-key algorithm: AES 128 bits
Password Hashing: PBKDF2, Scrypt, Bcrypt.
- NIST FIPS http://csrc.nist.gov/publications/PubsFIPS.html
- IV https://en.wikipedia.org/wiki/Initialization_vector
- OAEP http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding
- Cryptographic Storage Cheat Sheet