Broken Cipher (ARCH5112)

Key go.security.broken-cipher · Severity error · Category security · CWE CWE-327

Ciphers like DES, 3DES, RC4, and Blowfish are broken or no longer considered secure. A modern algorithm such as AES-GCM should be used to protect the confidentiality of sensitive data.

Incorrect

import "crypto/des"

block, _ := des.NewCipher(key)
ciphertext := make([]byte, len(plaintext))
block.Encrypt(ciphertext, plaintext)

Correct

import "crypto/aes"
import "crypto/cipher"

block, _ := aes.NewCipher(key) // 32 bytes = AES-256
gcm, _ := cipher.NewGCM(block)
ciphertext := gcm.Seal(nil, nonce, plaintext, nil)

Fix

Replace DES/3DES/RC4/Blowfish with a modern authenticated cipher such as AES-256-GCM.