CA5350: Do Not Use Weak Cryptographic Algorithms

#Cause

Encryption algorithms such as System.Security.Cryptography.TripleDES and hashing algorithms such as System.Security.Cryptography.SHA1 and System.Security.Cryptography.RIPEMD160 are considered to be weak.

These cryptographic algorithms do not provide as much security assurance as more modern counterparts. Cryptographic hashing algorithms System.Security.Cryptography.SHA1 and System.Security.Cryptography.RIPEMD160 provide less collision resistance than more modern hashing algorithms. The encryption algorithm System.Security.Cryptography.TripleDES provides fewer bits of security than more modern encryption algorithms.

#Rule description

Weak encryption algorithms and hashing functions are used today for a number of reasons, but they should not be used to guarantee the confidentiality of the data they protect.

The rule triggers when it finds 3DES, SHA1 or RIPEMD160 algorithms in the code and throws a warning to the user.

#How to fix violations

Use cryptographically stronger options:

• For TripleDES encryption, use System.Security.Cryptography.Aes encryption.

• For SHA1 or RIPEMD160 hashing functions, use ones in the SHA-2 family (for example, System.Security.Cryptography.SHA512, System.Security.Cryptography.SHA384, and System.Security.Cryptography.SHA256).

#When to suppress warnings

Suppress a warning from this rule when the level of protection needed for the data does not require a security guarantee.

#Suppress a warning

If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.

#pragma warning disable CA5350
// The code that's violating the rule is on this line.
#pragma warning restore CA5350

To disable the rule for a file, folder, or project, set its severity to none in the configuration file.

[*.{cs,vb}]
dotnet_diagnostic.CA5350.severity = none

For more information, see How to suppress code analysis warnings.

#Pseudo-code examples

As of the time of this writing, the following pseudo-code sample illustrates the pattern detected by this rule.

#SHA-1 Hashing Violation

using System.Security.Cryptography;
...
var hashAlg = SHA1.Create();

Solution:

using System.Security.Cryptography;
...
var hashAlg = SHA256.Create();

#RIPEMD160 Hashing Violation

using System.Security.Cryptography;
...
var hashAlg = RIPEMD160Managed.Create();

Solution:

using System.Security.Cryptography;
...
var hashAlg = SHA256.Create();

#TripleDES Encryption Violation

using System.Security.Cryptography;
...
using (TripleDES encAlg = TripleDES.Create())
{
  ...
}

Solution:

using System.Security.Cryptography;
...
using (AesManaged encAlg = new AesManaged())
{
  ...
}