Use of weak cryptographic algorithms
Why is this an issue?
Cryptographic algorithms such as MD5 and SHA1 are no longer considered secure. These algorithms have known vulnerabilities that allow attackers to find collisions or reverse hashes more easily than with modern alternatives.
Using weak cryptographic algorithms puts sensitive data at risk and may violate compliance requirements such as PCI-DSS or HIPAA.
Examples
Example of incorrect code:
Blob hash = Crypto.generateDigest('MD5', Blob.valueOf(data));
Blob hash = Crypto.generateDigest('SHA1', Blob.valueOf(data));
Blob mac = Crypto.generateMac('hmacSHA1', Blob.valueOf(data), Blob.valueOf(key));
Blob mac = Crypto.generateMac('hmacMD5', Blob.valueOf(data), Blob.valueOf(key));
Example of correct code:
Blob hash = Crypto.generateDigest('SHA-256', Blob.valueOf(data));
Blob hash = Crypto.generateDigest('SHA-512', Blob.valueOf(data));
Blob mac = Crypto.generateMac('hmacSHA256', Blob.valueOf(data), Blob.valueOf(key));
How can I fix violations?
Replace weak algorithms with stronger alternatives:
Weak algorithm | Recommended replacement |
MD5 | SHA-256 or SHA-512 |
SHA1 | SHA-256 or SHA-512 |
When should I disable this rule?
You may dismiss specific violations if you are integrating with legacy systems that require specific algorithms and cannot be updated.
Resources