Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "SecureSnaps/aescrypt.py" and "SecureSnaps/bfcrypt.py", I have identified security vulnerabilities about insecure cryptographic algorithm. Blowfish-ECB mode encryption is not semantically secure, which means it might cause information leakage. And Blowfish encryption is vulnerable to Sweet32 attack. AES-CBC with hardcode IV is insecure too.

Location:

https://github.com/NITDgpOS/SecureSnaps/blob/master/aescrypt.py#L31

obj = AES.new(password, AES.MODE_CBC, 'This is an IV456')

https://github.com/NITDgpOS/SecureSnaps/blob/master/bfcrypt.py#L32

crypt_obj = Blowfish.new(password, Blowfish.MODE_ECB)

Reference

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm
• **CWE-330: Use of Insufficiently Random Values **

Recommendate

• Use other cipher mode such as CBC or CTR with random IV.
• Generate IV with cryptographic secure PRNG.
• Use other block cipher, for example, AES-128.