New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[master] JCEEncryptor default encryption algorithm upgrade #2004

Merged

rfelcman merged 10 commits into eclipse-ee4j:master from rfelcman:encryptor_upgrade

Dec 1, 2023

Contributor

rfelcman commented Nov 21, 2023

JCEEncryptor default encryption algorithm upgrade from AES/CBC/PKCS5Padding to AES/GCM/NoPadding .

Plus extended unit test to verify backwards compatibility.

rfelcman added 5 commits

November 21, 2023 21:06


          JCEEncryptor default encryption algorithm upgrade from AES/CBC/PKCS5P…

8e48054

…adding to AES/GCM/NoPadding .

Plus extended unit test.

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>


          For AES/GCM/NoPadding random initialization vector (IV) instead of st…

f08d1c8

…atic one.

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>


          AES/GCM/NoPadding random initialization vector (IV) moved to the clas…

ba0959d

…s static context

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>


          JCEEncryptor warning message for old algorithm and new JCEEncryptorCm…

7e19e1d

…d to re-encrypt password.

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>


          shell scripts added, resource strings moved to localization bundle

87fc855

DBWS builder test fix

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>

lukasj reviewed

View reviewed changes

...e.persistence.core/src/main/java/org/eclipse/persistence/internal/security/JCEEncryptor.java Outdated Show resolved Hide resolved

lukasj reviewed

View reviewed changes

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java Outdated Show resolved Hide resolved

rfelcman added 4 commits

November 29, 2023 11:43


          Log WARNING constant reference change

af70503

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>


          Exception for old algorithm

b1925d6


          Empty string handle

e20a9b1


          Decryption fallback moved to JCEEncryptorCmd plus unit test update

9386b71

github-advanced-security bot found potential problems

View reviewed changes

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

+                      SecretKey sk = JCEEncryptorCmd.Synergizer.getAESCBCMultitasker();
+                      IvParameterSpec iv = JCEEncryptorCmd.Synergizer.getIvSpec();
+                      decryptCipherAES_CBC = Cipher.getInstance(AES_CBC);
+                      decryptCipherAES_CBC.init(Cipher.DECRYPT_MODE, sk, iv);

Check failure

Code scanning / CodeQL

Using a static initialization vector for encryption High

A

static initialization vector

should not be used for encryption.

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

+                  private final Cipher decryptCipherAES_CBC;
+                  public JCEEncryptorCmd() throws Exception {
+                      decryptCipherDES_ECB = Cipher.getInstance(DES_ECB);

Check failure

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

DES/ECB/PKCS5Padding

is insecure. It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead.
Cryptographic algorithm

DES/ECB/PKCS5Padding

is insecure. ECB mode, as in AES/ECB/NoPadding for example, is vulnerable to replay and other attacks. Consider using GCM instead.

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

+                      decryptCipherDES_ECB = Cipher.getInstance(DES_ECB);
+                      decryptCipherDES_ECB.init(Cipher.DECRYPT_MODE, JCEEncryptorCmd.Synergizer.getDESMultitasker());
+                      decryptCipherAES_ECB = Cipher.getInstance(AES_ECB);

Check failure

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

AES/ECB/PKCS5Padding

is insecure. ECB mode, as in AES/ECB/NoPadding for example, is vulnerable to replay and other attacks. Consider using GCM instead.

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

+                      SecretKey sk = JCEEncryptorCmd.Synergizer.getAESCBCMultitasker();
+                      IvParameterSpec iv = JCEEncryptorCmd.Synergizer.getIvSpec();
+                      decryptCipherAES_CBC = Cipher.getInstance(AES_CBC);

Check failure

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

AES/CBC/PKCS5Padding

is insecure. CBC mode with PKCS#5 or PKCS#7 padding is vulnerable to padding oracle attacks. Consider using GCM instead.

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java

+                  private static class Synergizer {
+                      private static SecretKey getDESMultitasker() throws Exception {
+                          SecretKeyFactory factory = SecretKeyFactory.getInstance("DES");

Check failure

Code scanning / CodeQL

Use of a broken or risky cryptographic algorithm High

Cryptographic algorithm

DES

is insecure. It has a short key length of 56 bits, making it vulnerable to brute-force attacks. Consider using AES instead.

lukasj reviewed

View reviewed changes

...e.persistence.core/src/main/java/org/eclipse/persistence/tools/security/JCEEncryptorCmd.java Show resolved Hide resolved


          Code cleanup

67fd7c3

lukasj approved these changes

View reviewed changes

rfelcman merged commit 149e9ce into eclipse-ee4j:master

3 of 4 checks passed

rfelcman deleted the encryptor_upgrade branch

December 6, 2023 08:22

rfelcman added a commit to rfelcman/eclipselink that referenced this pull request


          JCEEncryptor default encryption algorithm upgrade (eclipse-ee4j#2004)

68bcc55

JCEEncryptor default encryption algorithm upgrade from AES/CBC/PKCS5Padding to AES/GCM/NoPadding .
Plus extended unit test.
- for AES/GCM/NoPadding random initialization vector (IV) instead of static one.
- shell scripts added, resource strings moved to localization bundle
DBWS builder test fix

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>

(cherry picked from commit 149e9ce)
Signed-off-by: Radek Felcman <radek.felcman@oracle.com>

rfelcman added a commit that referenced this pull request


          JCEEncryptor default encryption algorithm upgrade (#2004) (#2122)

a92ca07

JCEEncryptor default encryption algorithm upgrade from AES/CBC/PKCS5Padding to AES/GCM/NoPadding .
Plus extended unit test.
- for AES/GCM/NoPadding random initialization vector (IV) instead of static one.
- shell scripts added, resource strings moved to localization bundle
DBWS builder test fix



(cherry picked from commit 149e9ce)

Signed-off-by: Radek Felcman <radek.felcman@oracle.com>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet