Skip to content

Weak cipher detection in javax.crypto.KeyGenerator#5634

Merged
DDJavierSantos merged 1 commit into
masterfrom
jsantos/weak_cipher_KeyGenerator
Aug 29, 2023
Merged

Weak cipher detection in javax.crypto.KeyGenerator#5634
DDJavierSantos merged 1 commit into
masterfrom
jsantos/weak_cipher_KeyGenerator

Conversation

@DDJavierSantos

@DDJavierSantos DDJavierSantos commented Jul 25, 2023

Copy link
Copy Markdown
Contributor

What Does This Do

Instruments javax.crypto.KeyGenerator so we can detect weak cypher vulnerabilities

Motivation

We need to cover all of the calls where the user can create a cypher with a weak algorithm including KeyGenerator and SecretKeyFactory

Additional Notes

@DDJavierSantos DDJavierSantos added the comp: asm iast Application Security Management (IAST) label Jul 25, 2023
@smola smola changed the title IAST - weak algorithm detection in javax.crypto.KeyGenerator Weak algorithm detection in javax.crypto.KeyGenerator Aug 1, 2023
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/weak_cipher_KeyGenerator branch 2 times, most recently from 4bf4061 to f927aa5 Compare August 9, 2023 15:58
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/weak_cipher_KeyGenerator branch from f927aa5 to 7cd7a38 Compare August 11, 2023 08:30
@pr-commenter

pr-commenter Bot commented Aug 11, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~995e9c41d8 1.20.0-SNAPSHOT~bf4c342317
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 62 cases.

Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (993.568 ms) : 0, 993568
Total [baseline] (8.667 s) : 0, 8666854
Agent [candidate] (994.931 ms) : 0, 994931
Total [candidate] (8.691 s) : 0, 8690651
section appsec
Agent [baseline] (1.072 s) : 0, 1071676
Total [baseline] (8.751 s) : 0, 8750562
Agent [candidate] (1.079 s) : 0, 1079102
Total [candidate] (8.743 s) : 0, 8743445
section iast
Agent [baseline] (1.089 s) : 0, 1089260
Total [baseline] (9.147 s) : 0, 9146834
Agent [candidate] (1.099 s) : 0, 1099041
Total [candidate] (9.178 s) : 0, 9177647
section profiling
Agent [baseline] (1.157 s) : 0, 1156554
Total [baseline] (8.845 s) : 0, 8844509
Agent [candidate] (1.165 s) : 0, 1165164
Total [candidate] (8.9 s) : 0, 8899783
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 993.568 ms -
Agent appsec 1.072 s 78.107 ms (7.9%)
Agent iast 1.089 s 95.692 ms (9.6%)
Agent profiling 1.157 s 162.986 ms (16.4%)
Total tracing 8.667 s -
Total appsec 8.751 s 83.708 ms (1.0%)
Total iast 9.147 s 479.98 ms (5.5%)
Total profiling 8.845 s 177.655 ms (2.0%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 994.931 ms -
Agent appsec 1.079 s 84.172 ms (8.5%)
Agent iast 1.099 s 104.11 ms (10.5%)
Agent profiling 1.165 s 170.234 ms (17.1%)
Total tracing 8.691 s -
Total appsec 8.743 s 52.794 ms (0.6%)
Total iast 9.178 s 486.995 ms (5.6%)
Total profiling 8.9 s 209.132 ms (2.4%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (615.876 ms) : 0, 615876
BytebuddyAgent [candidate] (616.964 ms) : 0, 616964
GlobalTracer [baseline] (286.24 ms) : 0, 286240
GlobalTracer [candidate] (286.406 ms) : 0, 286406
AppSec [baseline] (50.222 ms) : 0, 50222
AppSec [candidate] (50.291 ms) : 0, 50291
Remote Config [baseline] (668.06 µs) : 0, 668
Remote Config [candidate] (675.528 µs) : 0, 676
Telemetry [baseline] (6.006 ms) : 0, 6006
Telemetry [candidate] (6.053 ms) : 0, 6053
section appsec
BytebuddyAgent [baseline] (612.231 ms) : 0, 612231
BytebuddyAgent [candidate] (616.388 ms) : 0, 616388
GlobalTracer [baseline] (283.334 ms) : 0, 283334
GlobalTracer [candidate] (285.801 ms) : 0, 285801
AppSec [baseline] (135.384 ms) : 0, 135384
AppSec [candidate] (135.938 ms) : 0, 135938
Remote Config [baseline] (717.171 µs) : 0, 717
Remote Config [candidate] (752.512 µs) : 0, 753
Telemetry [baseline] (5.744 ms) : 0, 5744
Telemetry [candidate] (5.786 ms) : 0, 5786
section iast
BytebuddyAgent [baseline] (717.491 ms) : 0, 717491
BytebuddyAgent [candidate] (724.366 ms) : 0, 724366
GlobalTracer [baseline] (269.944 ms) : 0, 269944
GlobalTracer [candidate] (272.527 ms) : 0, 272527
AppSec [baseline] (47.24 ms) : 0, 47240
AppSec [candidate] (46.947 ms) : 0, 46947
IAST [baseline] (13.947 ms) : 0, 13947
IAST [candidate] (14.274 ms) : 0, 14274
Remote Config [baseline] (550.241 µs) : 0, 550
Remote Config [candidate] (579.024 µs) : 0, 579
Telemetry [baseline] (5.698 ms) : 0, 5698
Telemetry [candidate] (5.758 ms) : 0, 5758
section profiling
BytebuddyAgent [baseline] (623.182 ms) : 0, 623182
BytebuddyAgent [candidate] (629.288 ms) : 0, 629288
GlobalTracer [baseline] (346.931 ms) : 0, 346931
GlobalTracer [candidate] (350.028 ms) : 0, 350028
AppSec [baseline] (48.947 ms) : 0, 48947
AppSec [candidate] (49.433 ms) : 0, 49433
Remote Config [baseline] (647.313 µs) : 0, 647
Remote Config [candidate] (641.468 µs) : 0, 641
Telemetry [baseline] (6.025 ms) : 0, 6025
Telemetry [candidate] (5.973 ms) : 0, 5973
ProfilingAgent [baseline] (78.057 ms) : 0, 78057
ProfilingAgent [candidate] (76.631 ms) : 0, 76631
Profiling [baseline] (78.081 ms) : 0, 78081
Profiling [candidate] (76.655 ms) : 0, 76655
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (990.185 ms) : 0, 990185
Total [baseline] (9.182 s) : 0, 9181703
Agent [candidate] (991.03 ms) : 0, 991030
Total [candidate] (9.169 s) : 0, 9169090
section appsec
Agent [baseline] (1.071 s) : 0, 1071436
Total [baseline] (9.297 s) : 0, 9297229
Agent [candidate] (1.073 s) : 0, 1073029
Total [candidate] (9.255 s) : 0, 9255306
section iast
Agent [baseline] (1.097 s) : 0, 1097420
Total [baseline] (9.516 s) : 0, 9516203
Agent [candidate] (1.092 s) : 0, 1092483
Total [candidate] (9.472 s) : 0, 9471645
section profiling
Agent [baseline] (1.158 s) : 0, 1158387
Total [baseline] (9.406 s) : 0, 9406043
Agent [candidate] (1.166 s) : 0, 1165708
Total [candidate] (9.441 s) : 0, 9440659
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 990.185 ms -
Agent appsec 1.071 s 81.25 ms (8.2%)
Agent iast 1.097 s 107.234 ms (10.8%)
Agent profiling 1.158 s 168.202 ms (17.0%)
Total tracing 9.182 s -
Total appsec 9.297 s 115.527 ms (1.3%)
Total iast 9.516 s 334.5 ms (3.6%)
Total profiling 9.406 s 224.341 ms (2.4%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 991.03 ms -
Agent appsec 1.073 s 81.999 ms (8.3%)
Agent iast 1.092 s 101.453 ms (10.2%)
Agent profiling 1.166 s 174.679 ms (17.6%)
Total tracing 9.169 s -
Total appsec 9.255 s 86.216 ms (0.9%)
Total iast 9.472 s 302.555 ms (3.3%)
Total profiling 9.441 s 271.569 ms (3.0%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (615.208 ms) : 0, 615208
BytebuddyAgent [candidate] (615.3 ms) : 0, 615300
GlobalTracer [baseline] (283.564 ms) : 0, 283564
GlobalTracer [candidate] (284.65 ms) : 0, 284650
AppSec [baseline] (50.258 ms) : 0, 50258
AppSec [candidate] (49.996 ms) : 0, 49996
Remote Config [baseline] (666.273 µs) : 0, 666
Remote Config [candidate] (662.54 µs) : 0, 663
Telemetry [baseline] (6.009 ms) : 0, 6009
Telemetry [candidate] (5.955 ms) : 0, 5955
section appsec
BytebuddyAgent [baseline] (612.133 ms) : 0, 612133
BytebuddyAgent [candidate] (612.699 ms) : 0, 612699
GlobalTracer [baseline] (283.186 ms) : 0, 283186
GlobalTracer [candidate] (284.323 ms) : 0, 284323
AppSec [baseline] (135.368 ms) : 0, 135368
AppSec [candidate] (135.294 ms) : 0, 135294
Remote Config [baseline] (727.873 µs) : 0, 728
Remote Config [candidate] (722.657 µs) : 0, 723
Telemetry [baseline] (5.751 ms) : 0, 5751
Telemetry [candidate] (5.725 ms) : 0, 5725
section iast
BytebuddyAgent [baseline] (723.423 ms) : 0, 723423
BytebuddyAgent [candidate] (718.194 ms) : 0, 718194
GlobalTracer [baseline] (271.664 ms) : 0, 271664
GlobalTracer [candidate] (272.351 ms) : 0, 272351
AppSec [baseline] (47.509 ms) : 0, 47509
AppSec [candidate] (47.152 ms) : 0, 47152
IAST [baseline] (14.053 ms) : 0, 14053
IAST [candidate] (14.248 ms) : 0, 14248
Remote Config [baseline] (555.784 µs) : 0, 556
Remote Config [candidate] (583.595 µs) : 0, 584
Telemetry [baseline] (5.704 ms) : 0, 5704
Telemetry [candidate] (5.829 ms) : 0, 5829
section profiling
BytebuddyAgent [baseline] (625.045 ms) : 0, 625045
BytebuddyAgent [candidate] (629.958 ms) : 0, 629958
GlobalTracer [baseline] (347.367 ms) : 0, 347367
GlobalTracer [candidate] (350.248 ms) : 0, 350248
AppSec [baseline] (49.04 ms) : 0, 49040
AppSec [candidate] (48.859 ms) : 0, 48859
Remote Config [baseline] (638.022 µs) : 0, 638
Remote Config [candidate] (643.369 µs) : 0, 643
Telemetry [baseline] (5.971 ms) : 0, 5971
Telemetry [candidate] (5.983 ms) : 0, 5983
ProfilingAgent [baseline] (77.393 ms) : 0, 77393
ProfilingAgent [candidate] (76.796 ms) : 0, 76796
Profiling [baseline] (77.418 ms) : 0, 77418
Profiling [candidate] (76.82 ms) : 0, 76820
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~995e9c41d8 1.20.0-SNAPSHOT~bf4c342317
config baseline candidate
end_time 2023-08-28T15:30:19 2023-08-28T15:48:22
start_time 2023-08-28T15:30:02 2023-08-28T15:48:05
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8
    dateFormat X
    axisFormat %s
section baseline
no_agent (356.054 µs) : 336, 376
.   : milestone, 356,
appsec (651.058 µs) : 631, 671
.   : milestone, 651,
iast (450.719 µs) : 430, 472
.   : milestone, 451,
iast_FULL (515.36 µs) : 495, 536
.   : milestone, 515,
iast_INACTIVE (435.421 µs) : 415, 456
.   : milestone, 435,
profiling (424.552 µs) : 404, 445
.   : milestone, 425,
tracing (440.655 µs) : 420, 462
.   : milestone, 441,
section candidate
no_agent (358.239 µs) : 338, 378
.   : milestone, 358,
appsec (649.941 µs) : 630, 670
.   : milestone, 650,
iast (453.956 µs) : 433, 475
.   : milestone, 454,
iast_FULL (510.182 µs) : 490, 531
.   : milestone, 510,
iast_INACTIVE (432.138 µs) : 411, 453
.   : milestone, 432,
profiling (435.494 µs) : 415, 456
.   : milestone, 435,
tracing (432.087 µs) : 411, 453
.   : milestone, 432,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 356.054 µs [336.007 µs, 376.101 µs] -
appsec 651.058 µs [630.893 µs, 671.224 µs] 295.004 µs (82.9%)
iast 450.719 µs [429.908 µs, 471.53 µs] 94.665 µs (26.6%)
iast_FULL 515.36 µs [494.52 µs, 536.2 µs] 159.306 µs (44.7%)
iast_INACTIVE 435.421 µs [414.977 µs, 455.866 µs] 79.368 µs (22.3%)
profiling 424.552 µs [404.147 µs, 444.957 µs] 68.498 µs (19.2%)
tracing 440.655 µs [419.689 µs, 461.622 µs] 84.602 µs (23.8%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 358.239 µs [338.406 µs, 378.072 µs] -
appsec 649.941 µs [629.507 µs, 670.376 µs] 291.702 µs (81.4%)
iast 453.956 µs [433.245 µs, 474.668 µs] 95.717 µs (26.7%)
iast_FULL 510.182 µs [489.508 µs, 530.856 µs] 151.942 µs (42.4%)
iast_INACTIVE 432.138 µs [411.038 µs, 453.237 µs] 73.898 µs (20.6%)
profiling 435.494 µs [414.643 µs, 456.345 µs] 77.255 µs (21.6%)
tracing 432.087 µs [411.469 µs, 452.706 µs] 73.848 µs (20.6%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~bf4c342317, baseline=1.20.0-SNAPSHOT~995e9c41d8
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.336 ms) : 1317, 1355
.   : milestone, 1336,
appsec (1.647 ms) : 1623, 1672
.   : milestone, 1647,
iast (1.455 ms) : 1432, 1479
.   : milestone, 1455,
profiling (1.477 ms) : 1449, 1505
.   : milestone, 1477,
tracing (1.424 ms) : 1399, 1449
.   : milestone, 1424,
section candidate
no_agent (1.331 ms) : 1312, 1350
.   : milestone, 1331,
appsec (1.658 ms) : 1634, 1682
.   : milestone, 1658,
iast (1.455 ms) : 1432, 1479
.   : milestone, 1455,
profiling (1.447 ms) : 1422, 1471
.   : milestone, 1447,
tracing (1.435 ms) : 1411, 1459
.   : milestone, 1435,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.336 ms [1.317 ms, 1.355 ms] -
appsec 1.647 ms [1.623 ms, 1.672 ms] 311.105 µs (23.3%)
iast 1.455 ms [1.432 ms, 1.479 ms] 118.971 µs (8.9%)
profiling 1.477 ms [1.449 ms, 1.505 ms] 140.675 µs (10.5%)
tracing 1.424 ms [1.399 ms, 1.449 ms] 87.991 µs (6.6%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.331 ms [1.312 ms, 1.35 ms] -
appsec 1.658 ms [1.634 ms, 1.682 ms] 326.641 µs (24.5%)
iast 1.455 ms [1.432 ms, 1.479 ms] 124.24 µs (9.3%)
profiling 1.447 ms [1.422 ms, 1.471 ms] 115.448 µs (8.7%)
tracing 1.435 ms [1.411 ms, 1.459 ms] 104.081 µs (7.8%)

@DDJavierSantos
DDJavierSantos force-pushed the jsantos/weak_cipher_KeyGenerator branch 3 times, most recently from 99b6757 to cafdaf5 Compare August 21, 2023 11:45
@smola smola changed the title Weak algorithm detection in javax.crypto.KeyGenerator Weak cipher detection in javax.crypto.KeyGenerator Aug 21, 2023
@smola
smola force-pushed the jsantos/weak_cipher_KeyGenerator branch from cafdaf5 to 3fd36d4 Compare August 21, 2023 16:48
@smola
smola marked this pull request as ready for review August 21, 2023 16:49
@smola
smola requested a review from a team as a code owner August 21, 2023 16:49
@smola
smola requested a review from mcculls August 21, 2023 16:49
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/weak_cipher_KeyGenerator branch from 3fd36d4 to 3ffc77a Compare August 28, 2023 10:11
@DDJavierSantos
DDJavierSantos requested a review from a team as a code owner August 28, 2023 10:11
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/weak_cipher_KeyGenerator branch from 3ffc77a to bf4c342 Compare August 28, 2023 15:08
@DDJavierSantos
DDJavierSantos merged commit 1790e33 into master Aug 29, 2023
@DDJavierSantos
DDJavierSantos deleted the jsantos/weak_cipher_KeyGenerator branch August 29, 2023 09:17
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@manuel-alvarez-alvarez manuel-alvarez-alvarez manuel-alvarez-alvarez approved these changes
@mcculls mcculls Awaiting requested review from mcculls mcculls was automatically assigned from DataDog/apm-java
@cataphract cataphract Awaiting requested review from cataphract cataphract is a code owner automatically assigned from DataDog/asm-java

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

3 participants

@DDJavierSantos @smola @manuel-alvarez-alvarez