Zennoxa Shield
Rules / Java
SHIELD-JAVA-008

Weak Cipher Algorithm

highJavaCWE-327CVSS 7.5

What it detects

Cipher.getInstance using DES, RC4, or ECB mode provides inadequate confidentiality.

How to fix

Use AES in GCM or another authenticated mode with a securely managed key.

Vulnerable — Shield flags thisTokenCipher.java
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class TokenCipher {
    public byte[] encrypt(byte[] plaintext, SecretKeySpec key) throws Exception {
        Cipher cipher = Cipher.getInstance("DES/ECB/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        return cipher.doFinal(plaintext);
    }
}
Fixed — scans cleanTokenCipher.java
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public class TokenCipher {
    public byte[] encrypt(byte[] plaintext, SecretKeySpec key, byte[] iv) throws Exception {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
        return cipher.doFinal(plaintext);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-008: Weak Cipher Algorithm — Zennoxa Shield