Some cryptographic questions
- Dominant language
- Java
- Stars
- 17.4k
- Forks
- 5.7k
- PR merge metrics
- No merged PRs in 30d
Description
Hello! I'm new to DataX and when I was browsing the code I found some potential cryptographic risks.
1. DES and 3DES used
DES is used [here](https://github.com/alibaba/DataX/blob/master/common/src/main/java/com/alibaba/datax/common/util/DESCipher.java#L39) and 3DES is used [here](https://github.com/alibaba/DataX/blob/master/core/src/main/java/com/alibaba/datax/core/util/SecretUtil.java#L46). Both DES and 3DES are considered insecure. Is it for compacity?
```java
private final static String DES = "DES";
```
```java
public static final String KEY_ALGORITHM_3DES = "DESede";
```
2. Hardcoded key with an empty string
The key is hardcoded [here](https://github.com/alibaba/DataX/blob/master/common/src/main/java/com/alibaba/datax/common/util/DESCipher.java#L38). I know this empty string is a default key and will only be available when the key is not provided. But a default key with an empty string is also considered insecure, and generating a random string for the default key may be a better choice.
```java
public static final String KEY = "";
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading common/src/main/java/com/alibaba/datax/common/util/DESCipher.java and core/src/main/java/com/alibaba/datax/core/util/SecretUtil.java, focusing on the DES, 3DES, and default-key usages identified in the issue. Determine the intended security requirements and replacement approach; done should address the reported insecure algorithms and empty default key or document why they must remain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100