Rule Definition
Attacker can easily comprise the system if the HMAC keys are hard-coded.

Remediation
Provide appropriate values for the message and keys.

Violation Code Sample

Sample code (C#)

using (HMAC hmac = HMAC.Create("HMACSHA512"))
{
  string secureKey = "12345";
  byte[] SecureBytes = Encoding.ASCII.GetBytes(secureKey);
  hmac.Key = SecureBytes;
}

Fixed Code Sample

// Remediation Sample (C#)

using (HMAC hmac = HMAC.Create("HMACSHA512"))
{
    var rngCryptoServiceProvider = new RNGCryptoServiceProvider();
    byte[] randomBytes = new byte[keyLength];
    rngCryptoServiceProvider.GetBytes(randomBytes);
    hmac.Key = randomBytes;
}

A3-OWASP 2017 https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure A6-OWASP 2017 https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration CWE-321 https://cwe.mitre.org/data/definitions/321.html https://en.wikipedia.org/wiki/HMAC