Rule Definition
Optimal Asymmetric Encryption Padding schemes are often used with cryptographic algorithms to make the plaintext less predictable and complicate attack efforts. The OAEP scheme is often used with RSA to nullify the impact of predictable common text
Remediation
Federal agencies are encouraged to use the Advanced Encryption Standard, a faster and stronger algorithm approved as FIPS 197 in 2001.
Violation Code Sample
Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", "BC");
Fixed Code Sample
public class TestRSA {
public static void main(String[] args) throws Exception {
byte[] input = new byte[100];
Cipher cipher = Cipher.getInstance("RSA/None/NoPadding", "BC");
KeyFactory keyFactory = KeyFactory.getInstance("RSA", "BC");
Reference
MITRE CWE-780 - Use of RSA Algorithm without OAEP
MITRE CWE-327: Use of a Broken or Risky Cryptographic Algorithm
https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/
Related Technologies
Technical Criterion
Secure Coding - Weak Security Features
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.