alibaba / alibaba/DataX

Some cryptographic questions

Open
#2,119 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
17.4k
Forks
5.7k
PR merge metrics
No merged PRs in 30d

Description

Hello! I'm new to DataX and when I was browsing the code I found some potential cryptographic risks.

1. DES and 3DES used
DES is used [here](https://github.com/alibaba/DataX/blob/master/common/src/main/java/com/alibaba/datax/common/util/DESCipher.java#L39) and 3DES is used [here](https://github.com/alibaba/DataX/blob/master/core/src/main/java/com/alibaba/datax/core/util/SecretUtil.java#L46). Both DES and 3DES are considered insecure. Is it for compacity?
```java
private final static String DES = "DES";
```
```java
public static final String KEY_ALGORITHM_3DES = "DESede";
```

2. Hardcoded key with an empty string
The key is hardcoded [here](https://github.com/alibaba/DataX/blob/master/common/src/main/java/com/alibaba/datax/common/util/DESCipher.java#L38). I know this empty string is a default key and will only be available when the key is not provided. But a default key with an empty string is also considered insecure, and generating a random string for the default key may be a better choice.
```java
public static final String KEY = "";
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading common/src/main/java/com/alibaba/datax/common/util/DESCipher.java and core/src/main/java/com/alibaba/datax/core/util/SecretUtil.java, focusing on the DES, 3DES, and default-key usages identified in the issue. Determine the intended security requirements and replacement approach; done should address the reported insecure algorithms and empty default key or document why they must remain.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cryptography, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.