Zennoxa Shield
Rules / C#
SHIELD-CSHARP-011

Weak or broken cryptographic algorithm

highC#CWE-327CVSS 7.4

What it detects

A weak cipher or hash such as DES, TripleDES, RC2, MD5, or SHA1 is instantiated for security-sensitive use.

How to fix

Use AES with an authenticated mode for encryption and SHA-256 or stronger for hashing.

Vulnerable — Shield flags thisPasswordHasher.cs
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    public string Digest(string input)
    {
        using var md5 = new MD5CryptoServiceProvider();
        byte[] digest = md5.ComputeHash(Encoding.UTF8.GetBytes(input));
        return System.Convert.ToHexString(digest);
    }
}
Fixed — scans cleanPasswordHasher.cs
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    public string Digest(string input)
    {
        using var sha256 = SHA256.Create();
        byte[] digest = sha256.ComputeHash(Encoding.UTF8.GetBytes(input));
        return System.Convert.ToHexString(digest);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-011: Weak or broken cryptographic algorithm — Zennoxa Shield