Broken Cipher (ARCH4112)

Key java.security.broken-cipher · Severity error · Category security · CWE CWE-327

Ciphers such as DES, 3DES, RC4, and Blowfish are cryptographically weak or broken and must not be used for confidentiality. Prefer a modern authenticated cipher like AES-GCM.

Incorrect

Cipher cipher = Cipher.getInstance("DES/CBC/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, desKey, iv);
byte[] ct = cipher.doFinal(plaintext);

Correct

Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, aesKey, new GCMParameterSpec(128, iv));
byte[] ct = cipher.doFinal(plaintext);

Fix

Use a strong cipher such as AES-GCM (or AES-256) instead of DES/3DES/RC4/Blowfish.