Find weak cryptographic primitives
Recipe ID
org.openrewrite.kotlin.security.FindWeakCryptography$KtRecipeArtifact
io.moderne.recipe:recipes-kotlinBroken hash algorithms (MD2/MD5/SHA-1), broken or undersized ciphers (DES / 3DES / RC2 / RC4 / Blowfish / bare AES / AES-ECB), weak key material (DES key generation, DES SecretKeySpec, sub-2048-bit RSA), predictable IVs, and non-cryptographic random sources used in security-adjacent code.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.kotlin.security.FindWeakCryptography$KtRecipeIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:recipes-kotlin:0.2.0Definition
This recipe runs the following recipes in order.
- Find
MessageDigest.getInstance("MD2")callsorg.openrewrite.kotlin.security.FindWeakHashMd2$KtRecipe - Find
MessageDigest.getInstance("MD5")callsorg.openrewrite.kotlin.security.FindWeakHashMd5$KtRecipe - Find
MessageDigest.getInstance("SHA-1")callsorg.openrewrite.kotlin.security.FindWeakHashSha1$KtRecipe - Find
Cipher.getInstance("DES...")callsorg.openrewrite.kotlin.security.FindWeakCipherDes$KtRecipe - Find
Cipher.getInstance("DESede"/"TripleDES")callsorg.openrewrite.kotlin.security.FindWeakCipherTripleDes$KtRecipe - Find
Cipher.getInstance("RC2")callsorg.openrewrite.kotlin.security.FindWeakCipherRc2$KtRecipe - Find
Cipher.getInstance("RC4"/"ARCFOUR")callsorg.openrewrite.kotlin.security.FindWeakCipherRc4$KtRecipe - Find
Cipher.getInstance("Blowfish")callsorg.openrewrite.kotlin.security.FindWeakCipherBlowfish$KtRecipe - Find
Cipher.getInstance("AES/ECB/...")callsorg.openrewrite.kotlin.security.FindCipherEcbMode$KtRecipe - Find
Cipher.getInstance("AES")calls without a modeorg.openrewrite.kotlin.security.FindAesDefaultMode$KtRecipe - Find
Cipher.getInstance("AES/CBC/...")calls — verify integrityorg.openrewrite.kotlin.security.FindCipherCbcWithoutMac$KtRecipe - Find
KeyGenerator.getInstance("DES")callsorg.openrewrite.kotlin.security.FindKeyGeneratorDes$KtRecipe - Find
SecretKeySpec(_, "DES")constructionsorg.openrewrite.kotlin.security.FindSecretKeySpecDes$KtRecipe - Find
KeyPairGenerator.getInstance("RSA")callers — verify 2048+ key sizeorg.openrewrite.kotlin.security.FindRsaKeySizeBelow2048$KtRecipe - Find
IvParameterSpec(byteArrayOf(...))constructions with a literal IVorg.openrewrite.kotlin.security.FindPredictableIv$KtRecipe - Find
java.util.Random()allocationsorg.openrewrite.kotlin.security.FindJavaUtilRandomForSecurity$KtRecipe - Find
kotlin.random.Random.Defaultreferencesorg.openrewrite.kotlin.security.FindKotlinRandomForSecurity$KtRecipe - Find
String.toByteArray()calls without an explicit charsetorg.openrewrite.kotlin.security.FindStringToByteArrayDefaultCharset$KtRecipe - Find two-argument
Cipher.init(opmode, key)callsorg.openrewrite.kotlin.security.FindCipherInitWithoutSecureRandom$KtRecipe - Find
NullCipher()allocationsorg.openrewrite.kotlin.security.FindNullCipher$KtRecipe - Find
PBEKeySpec(..., iterations, ...)with low iteration countsorg.openrewrite.kotlin.security.FindPbkdf2LowIterationCount$KtRecipe - Find
SecureRandom.setSeed(...)with a literal seedorg.openrewrite.kotlin.security.FindSecureRandomSetSeed$KtRecipe
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats