Broken cipher algorithm (ARCH2112)

Key python.security.broken-cipher · Severity error · Category security · CWE CWE-327

Symmetric ciphers like DES, 3DES, RC4 and Blowfish are cryptographically weak or broken. Encrypting data that must stay confidential with these algorithms is no longer considered secure.

Incorrect

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

cipher = Cipher(algorithms.TripleDES(key), modes.CBC(iv))
ct = cipher.encryptor().update(data)

Correct

from cryptography.hazmat.primitives.ciphers.aead import AESGCM

aesgcm = AESGCM(AESGCM.generate_key(bit_length=256))
nonce = os.urandom(12)
ct = aesgcm.encrypt(nonce, data, None)

Fix

Use a modern authenticated cipher such as AES-256-GCM.