RSA algorithm with no padding detected.

• Rule ID: java_lang_rsa_no_padding
• Languages: java
• Source: rsa_no_padding.yml

Description

The RSA encryption algorithm is weak when used without Optimal Asymmetric Encryption Padding (OAEP).

Remediations

✅ Always use OAEP when using RSA encryption

  Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding")

Resources

• Java MessageDigest class

Associated CWE

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm
• CWE-780: Use of RSA Algorithm without OAEP

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_rsa_no_padding

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_rsa_no_padding