Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-008

Insecure DES or ECB cipher

highSwiftCWE-327CVSS 7.4

What it detects

DES algorithm or ECB mode is used, both of which are insecure.

How to fix

Use AES-GCM or another authenticated cipher with a secure mode instead of DES or ECB.

Vulnerable — Shield flags thisRecordCipher.swift
import CommonCrypto
import Foundation

func encryptRecord(_ plaintext: [UInt8], key: [UInt8]) -> [UInt8] {
    var out = [UInt8](repeating: 0, count: plaintext.count + kCCBlockSizeDES)
    var written = 0
    CCCrypt(CCOperation(kCCEncrypt), CCAlgorithm(kCCAlgorithmDES),
            CCOptions(kCCOptionECBMode), key, kCCKeySizeDES, nil,
            plaintext, plaintext.count, &out, out.count, &written)
    return Array(out.prefix(written))
}
Fixed — scans cleanRecordCipher.swift
import CryptoKit
import Foundation

func encryptRecord(_ plaintext: Data, key: SymmetricKey) throws -> Data {
    let sealed = try AES.GCM.seal(plaintext, using: key)
    return sealed.combined ?? Data()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-008: Insecure DES or ECB cipher — Zennoxa Shield