Broken or weak cipher (ARCH309)

Key dotnet.security.broken-cipher · Severity error · Category security · CWE CWE-327

DES, RC2, 3DES, and RC4 are no longer secure due to small key sizes or known weaknesses. Use authenticated AES.

Incorrect

using var des = DES.Create();
var encryptor = des.CreateEncryptor();

Correct

using var aes = new AesGcm(key, AesGcm.TagByteSizes.MaxSize);
aes.Encrypt(nonce, plaintext, ciphertext, tag);

Fix

Replace legacy ciphers with AES-GCM (or AES-256 in an authenticated mode).