This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.

To view the new OWASP Foundation website, please visit https://owasp.org

# Difference between revisions of "Testing for Weak Encryption (OTG-CRYPST-004)"

(→Basic Security Checklist) (Tag: Visual edit) |
|||

Line 16: | Line 16: | ||

Key exchange: Diffie–Hellman key exchange with minimum 2048 bits | Key exchange: Diffie–Hellman key exchange with minimum 2048 bits | ||

− | Message Integrity: HMAC-SHA2 | + | Message Integrity: HMAC-SHA2 |

− | + | Message Hash: SHA2 256 bits | |

− | Message Hash: SHA2 256 bits | + | Assymetric encryption: RSA 2048 bits |

− | + | Symmetric-key algorithm: AES 128 bits | |

− | Assymetric encryption: RSA 2048 bits | + | Password Hashing: PBKDF2, Scrypt, Bcrypt |

− | |||

− | Symmetric-key algorithm: AES 128 bits | ||

− | |||

− | Password Hashing: PBKDF2, Scrypt, Bcrypt | ||

== Tools == | == Tools == |

## Revision as of 01:29, 8 May 2017

## Summary

Incorrect uses of encryption algorithm may result in sensitive data exposure, key leakage, broken authentication, insecure session and spoofing attack. There are some encryption or hash algorithm is known to be weak and not suggested to be used anymore such MD5 and RC4.

In addition to the right choices of secure encryption or hash algorithm, the right uses of parameters also mater the security level. For example, ECB (Electronic Code Book) mode is not suggested to be used in asymmetric encryption.

The testing guide is trying to provide a guideline how to identify the weak encryption and hash.

## How to Test

### Basic Security Checklist

- The IV (Initialization vector) must be random and unpredictable. Refer to
*FIPS 140-2, Security Requirements for Cryptographic Modules*, section 4.9.1. random number generator tests. For example, in Java, "java.util.Random" is considered a weak random number generator. "java.security.SecureRandom" should be used instead of "java.util.Random". - When uses of RSA in encryption, Optimal Asymmetric Encryption Padding (OAEP) mode is recommended.
- When uses of RSA in signature, PSS padding is recommended.
- Weak hash/encryption algorithms should not be used such MD5, RC4, SHA1.
- Minium Key length requirment:

Key exchange: Diffie–Hellman key exchange with minimum 2048 bits

Message Integrity: HMAC-SHA2 Message Hash: SHA2 256 bits Assymetric encryption: RSA 2048 bits Symmetric-key algorithm: AES 128 bits Password Hashing: PBKDF2, Scrypt, Bcrypt

## Tools

## References

- NIST FIPS http://csrc.nist.gov/publications/PubsFIPS.html
- IV https://en.wikipedia.org/wiki/Initialization_vector
- https://www.securecoding.cert.org/confluence/display/java/MSC02-J.+Generate+strong+random+numbers
- OAEP http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding
- Cryptographic Storage Cheat Sheet