CA5385: Use Rivest–Shamir–Adleman (RSA) algorithm with sufficient key size

#Cause

Using asymmetric encryption algorithm RSA with key size less than 2048 in one of the following ways:

• Instantiating any descendant classes of System.Security.Cryptography.RSA and specifying the KeySize parameter as less than 2048.
• Returning any object whose type is descendant of System.Security.Cryptography.RSA.
• Using System.Security.Cryptography.AsymmetricAlgorithm.Create without parameter which would create RSA with the default key size 1024.
• Using System.Security.Cryptography.AsymmetricAlgorithm.Create and specifying the algName parameter as RSA with the default key size 1024.
• Using System.Security.Cryptography.CryptoConfig.CreateFromName and specifying the name parameter as RSA with the default key size 1024.
• Using System.Security.Cryptography.CryptoConfig.CreateFromName and specifying the name parameter as RSA and specifying the key size as smaller than 2048 explicitly by args.

#Rule description

An RSA key smaller than 2048 bits is more vulnerable to brute force attacks.

#How to fix violations

Switch to an RSA with at least 2048 key size, ECDH or ECDsa algorithm instead.

#When to suppress warnings

It is not recommended to suppress this rule unless for compatibility with legacy applications and data.

#Suppress a warning

If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.

#pragma warning disable CA5385
// The code that's violating the rule is on this line.
#pragma warning restore CA5385

To disable the rule for a file, folder, or project, set its severity to none in the configuration file.

[*.{cs,vb}]
dotnet_diagnostic.CA5385.severity = none

For more information, see How to suppress code analysis warnings.

#Example

The following code snippet illustrates the pattern detected by this rule.

Violation:

using System.Security.Cryptography;

class ExampleClass
{
    public void ExampleMethod()
    {
        RSACng rsaCng = new RSACng(1024);
    }
}

Solution:

using System.Security.Cryptography;

class ExampleClass
{
    public void ExampleMethod()
    {
        RSACng rsaCng = new RSACng(2048);
    }
}