Misuse of crypto API: usage of HmacSHA1

I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses, and one was within this project.

• The class PaymentGatewayTamperProofSealServiceImpl [2] uses HmacSHA1 as a parameter to the initialization of the class SecretKeySpec. By now, it is possible to have collisions with SHA1 and thus are not considered secure any longer. Therefore, one should not use it any longer when one can not guarantee that the private key stays private. Instead, more modern algorithms like HmacSHA256, HmacSHA384, HmacSHA512 should be used.

[1] https://github.com/CROSSINGTUD/CryptoAnalysis
[2] https://sourcegraph.com/github.com/BroadleafCommerce/BroadleafCommerce/-/blob/common/src/main/java/org/broadleafcommerce/common/payment/service/PaymentGatewayTamperProofSealServiceImpl.java?L44

Start at common/src/main/java/org/broadleafcommerce/common/payment/service/PaymentGatewayTamperProofSealServiceImpl.java, especially the SecretKeySpec initialization around line 44. Confirm how the payment gateway seal is generated and replace the reported HmacSHA1 usage with an appropriate HMAC-SHA-2 algorithm. Done means the service no longer initializes the key with HmacSHA1 and its seal behavior remains valid.