2021-06-03 09:05:38 +02:00
|
|
|
=== relates to: S4787
|
2021-06-02 20:44:38 +02:00
|
|
|
|
2021-06-03 09:05:38 +02:00
|
|
|
=== on 2 Oct 2014, 15:37:17 Ann Campbell wrote:
|
2021-06-02 20:44:38 +02:00
|
|
|
\[~nicolas.peru] I've mapped this to find-sec-bugs:RSA_KEY_SIZE but the CWE page talks mainly about Base64 encoding. Is a key size check doable?
|
|
|
|
|
|
2021-06-03 09:05:38 +02:00
|
|
|
=== on 8 Oct 2014, 08:34:54 Nicolas Peru wrote:
|
2021-06-02 20:44:38 +02:00
|
|
|
RSA_KEY_SIZE checks the ``++KeyPairGenerator++`` class and the calls to ``++getInstance++`` and ``++initialize++`` methods.
|
|
|
|
|
|
|
|
|
|
Those are a little bit different as Base64 is not an encryption mechanism whereas the other is correct but weak.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
We can still squash them into one rule though.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
