Hi folks,
There's a piece of code written in our application and it was flagged during security vulnerability testing, it's related to application security. It's totally Greek and Latin to me, any help on what to be done, would be great?
Code:
-----------
private static String ALGORITHM = "DESede";
public static byte[] encryptByteArray(String input) throws InvalidKeyException, BadPaddingException, IllegalBlockSizeException, NoSuchAlgorithmException, NoSuchPaddingException {
Key key = generateKey();
Cipher cipher = Cipher.getInstance(ALGORITHM);
cipher.init(Cipher.ENCRYPT_MODE, key);
byte[] inputBytes = input.getBytes();
inputBytes = cipher.doFinal(inputBytes);
return Base64.encodeBase64(inputBytes);
}
Comments
--------------
Not implementing proper encryption leads to compromise of confidentiality.
1. Weak ciphers are generally known as encryption/ decryption algorithms that use key sizes that are less than 128 bits and vulnerable to most of the attacks.
2. Weak encoding algorithms are easy to decode.