Broken cipher (ARCH3112)

Key typescript.security.broken-cipher · Severity error · Category security · CWE CWE-327

Legacy symmetric ciphers such as DES, 3DES, RC4, and Blowfish are cryptographically broken and do not provide confidentiality. Use a modern, authenticated cipher to protect sensitive data.

Incorrect

import { createCipheriv } from "crypto";

const cipher = createCipheriv("des-ede3-cbc", key, iv);
const encrypted = cipher.update(secret, "utf8", "hex") + cipher.final("hex");

Correct

import { createCipheriv } from "crypto";

const cipher = createCipheriv("aes-256-gcm", key, iv);
const encrypted = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
const tag = cipher.getAuthTag();

Fix

Replace DES/3DES/RC4/Blowfish with a modern authenticated cipher such as AES-256-GCM.