Skip to content

Commit 2429c6c

Browse files
RasmusWLRasmusWL
committed
Python: Rewrite py/weak-crypto-key tests
* Removed backend arugment that is not required * Added DSA constants (they are just accidentially the same as RSA right now) * Removed FakeWeakEllipticCurve and used a real weak elliptic curve instead
1 parent d5ff477 commit 2429c6c

2 files changed

Lines changed: 45 additions & 44 deletions

File tree

‎python/ql/test/query-tests/Security/CWE-326/WeakCrypto.expected‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
| weak_crypto.py:67:1:67:30 | ControlFlowNode for dsa_gen_key() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
2-
| weak_crypto.py:68:1:68:28 | ControlFlowNode for ec_gen_key() | Creation of an ECC key uses $@ bits, which is below 224 and considered breakable. | weak_crypto.py:21:11:21:33 | ControlFlowNode for FakeWeakEllipticCurve() | 160 |
3-
| weak_crypto.py:69:1:69:37 | ControlFlowNode for rsa_gen_key() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
4-
| weak_crypto.py:71:1:71:39 | ControlFlowNode for dsa_gen_key() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
5-
| weak_crypto.py:72:1:72:34 | ControlFlowNode for ec_gen_key() | Creation of an ECC key uses $@ bits, which is below 224 and considered breakable. | weak_crypto.py:21:11:21:33 | ControlFlowNode for FakeWeakEllipticCurve() | 160 |
6-
| weak_crypto.py:73:1:73:46 | ControlFlowNode for rsa_gen_key() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
7-
| weak_crypto.py:75:1:75:22 | ControlFlowNode for Attribute() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
8-
| weak_crypto.py:76:1:76:22 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
1+
| weak_crypto.py:68:1:68:21 | ControlFlowNode for dsa_gen_key() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:16:12:16:15 | ControlFlowNode for IntegerLiteral | 1024 |
2+
| weak_crypto.py:69:1:69:19 | ControlFlowNode for ec_gen_key() | Creation of an ECC key uses $@ bits, which is below 224 and considered breakable. | weak_crypto.py:22:11:22:24 | ControlFlowNode for Attribute() | 163 |
3+
| weak_crypto.py:70:1:70:28 | ControlFlowNode for rsa_gen_key() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
4+
| weak_crypto.py:72:1:72:30 | ControlFlowNode for dsa_gen_key() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:16:12:16:15 | ControlFlowNode for IntegerLiteral | 1024 |
5+
| weak_crypto.py:73:1:73:25 | ControlFlowNode for ec_gen_key() | Creation of an ECC key uses $@ bits, which is below 224 and considered breakable. | weak_crypto.py:22:11:22:24 | ControlFlowNode for Attribute() | 163 |
6+
| weak_crypto.py:74:1:74:37 | ControlFlowNode for rsa_gen_key() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |
7+
| weak_crypto.py:76:1:76:22 | ControlFlowNode for Attribute() | Creation of an DSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:16:12:16:15 | ControlFlowNode for IntegerLiteral | 1024 |
8+
| weak_crypto.py:77:1:77:22 | ControlFlowNode for Attribute() | Creation of an RSA key uses $@ bits, which is below 2048 and considered breakable. | weak_crypto.py:12:12:12:15 | ControlFlowNode for IntegerLiteral | 1024 |

‎python/ql/test/query-tests/Security/CWE-326/weak_crypto.py‎

Lines changed: 37 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
from cryptography.hazmat import backends
22
from cryptography.hazmat.primitives.asymmetric import ec, dsa, rsa
33

4-
#Crypto and Cryptodome have same API
4+
# Crypto and Cryptodome have same API
55
if random():
66
from Crypto.PublicKey import DSA
77
from Crypto.PublicKey import RSA
@@ -12,13 +12,14 @@
1212
RSA_WEAK = 1024
1313
RSA_OK = 2048
1414
RSA_STRONG = 3076
15-
BIG = 10000
1615

17-
class FakeWeakEllipticCurve:
18-
name = "fake"
19-
key_size = 160
16+
DSA_WEAK = 1024
17+
DSA_OK = 2048
18+
DSA_STRONG = 3076
19+
20+
BIG = 10000
2021

21-
EC_WEAK = FakeWeakEllipticCurve()
22+
EC_WEAK = ec.SECT163K1() # has key size of 163
2223
EC_OK = ec.SECP224R1()
2324
EC_STRONG = ec.SECP384R1()
2425
EC_BIG = ec.SECT571R1()
@@ -27,50 +28,50 @@ class FakeWeakEllipticCurve:
2728
ec_gen_key = ec.generate_private_key
2829
rsa_gen_key = rsa.generate_private_key
2930

30-
default = backends.default_backend()
3131

32-
#Strong and OK keys.
3332

34-
dsa_gen_key(key_size=RSA_OK, backend=default)
35-
dsa_gen_key(key_size=RSA_STRONG, backend=default)
36-
dsa_gen_key(key_size=BIG, backend=default)
37-
ec_gen_key(curve=EC_OK, backend=default)
38-
ec_gen_key(curve=EC_STRONG, backend=default)
39-
ec_gen_key(curve=EC_BIG, backend=default)
40-
rsa_gen_key(public_exponent=65537, key_size=RSA_OK, backend=default)
41-
rsa_gen_key(public_exponent=65537, key_size=RSA_STRONG, backend=default)
42-
rsa_gen_key(public_exponent=65537, key_size=BIG, backend=default)
33+
# Strong and OK keys.
34+
35+
dsa_gen_key(key_size=DSA_OK)
36+
dsa_gen_key(key_size=DSA_STRONG)
37+
dsa_gen_key(key_size=BIG)
38+
ec_gen_key(curve=EC_OK)
39+
ec_gen_key(curve=EC_STRONG)
40+
ec_gen_key(curve=EC_BIG)
41+
rsa_gen_key(public_exponent=65537, key_size=RSA_OK)
42+
rsa_gen_key(public_exponent=65537, key_size=RSA_STRONG)
43+
rsa_gen_key(public_exponent=65537, key_size=BIG)
4344

4445
DSA.generate(bits=RSA_OK)
4546
DSA.generate(bits=RSA_STRONG)
4647
RSA.generate(bits=RSA_OK)
4748
RSA.generate(bits=RSA_STRONG)
4849

49-
dsa_gen_key(RSA_OK, default)
50-
dsa_gen_key(RSA_STRONG, default)
51-
dsa_gen_key(BIG, default)
52-
ec_gen_key(EC_OK, default)
53-
ec_gen_key(EC_STRONG, default)
54-
ec_gen_key(EC_BIG, default)
55-
rsa_gen_key(65537, RSA_OK, default)
56-
rsa_gen_key(65537, RSA_STRONG, default)
57-
rsa_gen_key(65537, BIG, default)
58-
59-
DSA.generate(RSA_OK)
60-
DSA.generate(RSA_STRONG)
50+
dsa_gen_key(DSA_OK)
51+
dsa_gen_key(DSA_STRONG)
52+
dsa_gen_key(BIG)
53+
ec_gen_key(EC_OK)
54+
ec_gen_key(EC_STRONG)
55+
ec_gen_key(EC_BIG)
56+
rsa_gen_key(65537, RSA_OK)
57+
rsa_gen_key(65537, RSA_STRONG)
58+
rsa_gen_key(65537, BIG)
59+
60+
DSA.generate(DSA_OK)
61+
DSA.generate(DSA_STRONG)
6162
RSA.generate(RSA_OK)
6263
RSA.generate(RSA_STRONG)
6364

6465

6566
# Weak keys
6667

67-
dsa_gen_key(RSA_WEAK, default)
68-
ec_gen_key(EC_WEAK, default)
69-
rsa_gen_key(65537, RSA_WEAK, default)
68+
dsa_gen_key(DSA_WEAK)
69+
ec_gen_key(EC_WEAK)
70+
rsa_gen_key(65537, RSA_WEAK)
7071

71-
dsa_gen_key(key_size=RSA_WEAK, default)
72-
ec_gen_key(curve=EC_WEAK, default)
73-
rsa_gen_key(65537, key_size=RSA_WEAK, default)
72+
dsa_gen_key(key_size=DSA_WEAK)
73+
ec_gen_key(curve=EC_WEAK)
74+
rsa_gen_key(65537, key_size=RSA_WEAK)
7475

75-
DSA.generate(RSA_WEAK)
76+
DSA.generate(DSA_WEAK)
7677
RSA.generate(RSA_WEAK)

0 commit comments

Comments
 (0)