OculusCyber Logo

OculusCyber

Home

Browse Topics

Security Best Practices

AI Security Frameworks

Threat Intelligence

Compliance

Cryptographic Failures

By Admin

•

November 9, 2025

Bad Example (Cryptographic Failure)

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class WeakCryptoExample {
    public static void main(String[] args) throws Exception {
        String data = "SensitivePassword123";

        // ❌ Using hardcoded key and weak algorithm (ECB mode, no IV)
        String key = "1234567890123456"; // 16 bytes
        SecretKeySpec secretKey = new SecretKeySpec(key.getBytes(), "AES");

        Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); // ECB = insecure
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);

        byte[] encrypted = cipher.doFinal(data.getBytes());
        String encoded = Base64.getEncoder().encodeToString(encrypted);

        System.out.println("Encrypted: " + encoded);
    }
}

⚠️ What's wrong:

  • Hardcoded key → easily recoverable in source code.
  • Static key → no rotation or key management.
  • ECB mode → leaks data patterns (e.g., identical blocks produce identical ciphertext).
  • No IV (Initialization Vector) → vulnerable to replay and pattern analysis.
  • Violates CWE-327: Use of Broken or Risky Cryptographic Algorithm and CWE-321: Hardcoded Keys.

✅ Good Example (Proper Encryption with AES-GCM & Secure Key Handling)

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import java.security.SecureRandom;
import java.util.Base64;

public class SecureCryptoExample {
    private static final int AES_KEY_SIZE = 256;
    private static final int GCM_TAG_LENGTH = 128;

    public static void main(String[] args) throws Exception {
        String data = "SensitivePassword123";

        // ✅ Generate a strong random AES key
        KeyGenerator keyGen = KeyGenerator.getInstance("AES");
        keyGen.init(AES_KEY_SIZE);
        SecretKey key = keyGen.generateKey();

        // ✅ Generate a random IV (unique per encryption)
        byte[] iv = new byte[12];
        new SecureRandom().nextBytes(iv);

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.ENCRYPT_MODE, key, spec);

        byte[] encrypted = cipher.doFinal(data.getBytes());
        String encryptedText = Base64.getEncoder().encodeToString(encrypted);

        System.out.println("Encrypted: " + encryptedText);
        System.out.println("IV (Base64): " + Base64.getEncoder().encodeToString(iv));
        System.out.println("Key (Base64): " + Base64.getEncoder().encodeToString(key.getEncoded()));
    }
}

✅ Why this works:

  • Uses AES-256 in GCM mode (authenticated encryption).
  • Generates a random key — no hardcoding.
  • Uses SecureRandom for IV generation.
  • Includes integrity via GCM tag (protects against tampering).
  • Key can be safely stored in an HSM, AWS KMS, or Vault, not code.

Best Practices

  • Never hardcode secrets or keys. Use secure vaults or cloud KMS.
  • Always use AES-GCM or ChaCha20-Poly1305 — avoid ECB, CBC, DES, RC4.
  • Use SecureRandom instead of Random.
  • Enforce TLS 1.2+ for data in transit.
  • Regularly rotate encryption keys.
  • Validate integrity (MAC or GCM tag).