Broken Cipher (ARCH6112)

Key ruby.security.broken-cipher · Severity error · Category security · CWE CWE-327

Ciphers like DES, 3DES, RC4, and Blowfish are cryptographically broken or have inadequate block/key sizes. Use a modern AEAD cipher (AES-GCM) to protect confidential data.

Incorrect

require "openssl"

cipher = OpenSSL::Cipher.new("DES-CBC")
cipher.encrypt
cipher.key = key
encrypted = cipher.update(plaintext) + cipher.final

Correct

require "openssl"

cipher = OpenSSL::Cipher.new("aes-256-gcm")
cipher.encrypt
cipher.key = key
iv = cipher.random_iv
encrypted = cipher.update(plaintext) + cipher.final
tag = cipher.auth_tag

Fix

Replace legacy ciphers with authenticated AES-256-GCM.