2023-05-03 11:06:20 +02:00
== Why is this an issue?
2021-04-26 17:29:13 +02:00
include::../description.adoc[]
2021-02-02 15:02:10 +01:00
2023-05-03 11:06:20 +02:00
=== Noncompliant code example
2020-06-30 12:49:37 +02:00
2021-04-26 17:29:13 +02:00
``++javax.net.ssl.SSLContext++`` library:
2021-02-02 15:02:10 +01:00
2022-02-04 17:28:24 +01:00
[source,java]
2021-04-26 17:29:13 +02:00
----
context = SSLContext.getInstance("TLSv1.1"); // Noncompliant
----
2020-06-30 12:49:37 +02:00
2021-04-26 17:29:13 +02:00
https://square.github.io/okhttp/[okhttp] library:
2021-02-02 15:02:10 +01:00
2022-02-04 17:28:24 +01:00
[source,java]
2021-04-26 17:29:13 +02:00
----
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_1) // Noncompliant
.build();
----
2020-06-30 12:49:37 +02:00
2023-05-03 11:06:20 +02:00
=== Compliant solution
2021-04-26 17:29:13 +02:00
``++javax.net.ssl.SSLContext++`` library:
2020-06-30 12:49:37 +02:00
2022-02-04 17:28:24 +01:00
[source,java]
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
context = SSLContext.getInstance("TLSv1.2"); // Compliant
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
https://square.github.io/okhttp/[okhttp] library:
2020-06-30 12:49:37 +02:00
2022-02-04 17:28:24 +01:00
[source,java]
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_2) // Compliant
.build();
2020-06-30 12:49:37 +02:00
----
2023-05-03 11:06:20 +02:00
== Resources
2021-02-18 15:34:22 +01:00
2021-11-01 15:00:32 +01:00
* https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[OWASP Top 10 2021 Category A2] - Cryptographic Failures
* https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[OWASP Top 10 2021 Category A7] - Identification and Authentication Failures
2022-07-08 13:58:56 +02:00
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration
2022-04-07 08:53:59 -05:00
* https://cwe.mitre.org/data/definitions/326[MITRE, CWE-327] - Inadequate Encryption Strength
* https://cwe.mitre.org/data/definitions/327[MITRE, CWE-326] - Use of a Broken or Risky Cryptographic Algorithm
2021-02-18 15:34:22 +01:00
* https://www.sans.org/top25-software-errors/#cat3[SANS Top 25] - Porous Defenses
* https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https[Diagnosing TLS, SSL, and HTTPS]
* https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#22-use-secure-protocols[SSL and TLS Deployment Best Practices - Use secure protocols]
2021-06-02 20:44:38 +02:00
2021-06-03 09:05:38 +02:00
ifdef::env-github,rspecator-view[]
2021-09-20 15:38:42 +02:00
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
include::../highlighting.adoc[]
2021-06-08 15:52:13 +02:00
'''
2021-06-02 20:44:38 +02:00
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
2021-06-03 09:05:38 +02:00
endif::env-github,rspecator-view[]
