Use secure mode and padding scheme for ECB Not Detected Consistently Across C/JAVA Languages

[kirkpabk (Brian Kirkpatrick)]

Appears that the equivalent flawed algorithm for ECB in C is not detected as it is in Java for the ECB cipher init method.

Encryption algorithms should be used with secure mode and padding scheme c:S5542
#define MODE_ECB = 1
…
rc = cipherInit(&cipher, MODE_ECB, NULL); NOT DETECTED

Encryption algorithms should be used with secure mode and padding scheme java:S5542
private static final String algorithm = “AES”;
private String transformation = algorithm + “/ECB/PKCS5Padding”;
Cipher cipher = Cipher.getInstance(transformation);
cipher.init(Cipher.ENCRYPT_MODE, keySpec); DETECTED

[Hendrik_Buchwald]

Hello Brian,

Could you please provide more information on what library you are using in C? Thanks!

[Pierre-Loup_Tristant]

Hi @kirkpabk

@kirkpabk

#define MODE_ECB = 1
…
rc = cipherInit(&cipher, MODE_ECB, NULL); NOT DETECTED

Are you using gnulib crypto? We don’t support this library for the moment and this explains why the issue is not found.

[kirkpabk (Brian Kirkpatrick)]

Thanks–I think that might be it.