Weak RSA key size (ARCH4117)

Key java.security.weak-rsa-key-size · Severity warning · Category security · CWE CWE-326

RSA or DSA keys below 2048 bits are no longer considered secure; they are inadequate against factoring attacks and fail modern compliance standards.

Incorrect

KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
gen.initialize(1024);
KeyPair kp = gen.generateKeyPair();

Correct

KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
gen.initialize(2048);
KeyPair kp = gen.generateKeyPair();

Fix

Generate RSA keys at 2048 bits or more; prefer 3072 bits or curve-based algorithms for longer-term protection.