계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

Weak Encryption: Byte Array to String Conversion

Java/JSP

Abstract

암호화 키가 String으로 변환되므로 엔트로피가 크게 손실될 수 있습니다.

Explanation

약한 암호화: 바이트 배열을 문자열로 변환 문제는 다음과 같은 경우에 발생합니다.

1. 암호화 키를 바이트 배열로 만드는 경우

2. 데이터를 String으로 변환하는 경우

예제 1: 다음 코드는 암호화 키를 만든 다음 String으로 변환합니다.


import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
  ...
  KeyGenerator keygen = KeyGenerator.newInstance("AES");
  ...
  SecretKey cryptoKey = keygen.generateKey();
  byte[] rawCryptoKey = cryptoKey.getEncoded();
  ...
  String key = new String(rawCryptoKey);
  ...

이 코드는 기본 시스템 문자 집합을 사용하여 암호화 키를 String으로 변환합니다. 그러나 이 문자 집합의 유효한 범위 외부에서 생성자에 바이트를 제공할 때 수행되는 작업은 지정되지 않은 상태입니다. 따라서 key에서는 원래 암호화 키 rawCryptoKey에 비해 엔트로피가 크게 손실될 가능성이 높습니다.

References

[1] STR03-J. Do not encode noncharacter data as a string CERT

[2] When 'EFBFBD' and Friends Come Knocking: Observations of Byte Array to String Conversions GDS Security

[3] Standards Mapping - Common Weakness Enumeration CWE ID 320

[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002450

[5] Standards Mapping - FIPS200 MP

[6] Standards Mapping - General Data Protection Regulation (GDPR) Insufficient Data Protection

[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-10 Non-Repudiation (P2), SC-12 Cryptographic Key Establishment and Management (P1), SC-13 Cryptographic Protection (P1)

[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-10 Non-Repudiation, SC-12 Cryptographic Key Establishment and Management, SC-13 Cryptographic Protection

[9] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.6.2 Cryptographic Architectural Requirements (L2 L3), 2.8.2 Single or Multi Factor One Time Verifier Requirements (L2 L3), 2.9.1 Cryptographic Software and Devices Verifier Requirements (L2 L3), 2.6.3 Look-up Secret Verifier Requirements (L2 L3), 6.4.2 Secret Management (L2 L3), 6.2.1 Algorithms (L1 L2 L3)

[10] Standards Mapping - OWASP Mobile 2014 M6 Broken Cryptography

[11] Standards Mapping - OWASP Mobile 2024 M10 Insufficient Cryptography

[12] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CRYPTO-1

[13] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[14] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[15] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[16] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[17] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[18] Standards Mapping - OWASP Top 10 2021 A02 Cryptographic Failures

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 3.6.1, Requirement 6.5.8

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 3.6.1, Requirement 6.3.1.3, Requirement 6.5.8

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 3.6.1, Requirement 6.5.3

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 3.6.1, Requirement 6.5.3

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 3.6.1, Requirement 6.5.3

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 3.6.1, Requirement 6.5.3

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 3.6.1, Requirement 6.5.3

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 3.6.1, Requirement 6.2.4

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 3.3.2, Requirement 3.3.3, Requirement 3.5.1, Requirement 3.6.1, Requirement 6.2.4

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 7.1 - Use of Cryptography, Control Objective 7.4 - Use of Cryptography

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 7.1 - Use of Cryptography, Control Objective 7.4 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 7.1 - Use of Cryptography, Control Objective 7.4 - Use of Cryptography, Control Objective B.2.3 - Terminal Software Design

[31] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3150.1 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3150.1 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3150.1 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3150.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3150.1 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3150.1 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3150.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000590 CAT II, APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000590 CAT II, APSC-DV-002010 CAT II, APSC-DV-002040 CAT II

desc.dataflow.java.weak_encryption_byte_array_to_string_conversion