0

I have a method that obtains the secret key to be able to encrypt with AES.The secret key is stored in database. As seen in the method, I use a Stored procedure to get the secret key value and assign it to a byte array.

CheckMarx is finding me vulnerable Use hardcoded cryptographic key. The key is not hard-coded since it is in the database. Source Object:

private static final  String CADENA_VACIA= "";
private static final  int CERO =1;
private static final  int UNO = 1;

Code Java:

private static byte[] keyValue  = new byte[16];
private static final  String CADENA_VACIA= "";
private static final  int CERO =1;
private static final  int UNO = 1;

private static void getkeyValue() {     

    SQLConecctionClass sql = new SQLConecctionClass(EnvironmentCLS.POOL);
    Vector rs = null;
    String seed = STR_EMPTY;

    try {           
        rs = sql.execute("BD..SPD_CONFIG_MANAGEKEY '" + "AES_KEY" + "'");
        for (int i = CERO; i < rs.size(); i++) {
            Vector rsTmpLoc = (Vector) rs.elementAt(i);
            for (int j = UNO; j < rsTmpLoc.size(); j++) {
                Vector rsRLoc = (Vector) rsTmpLoc.elementAt(j);
                seed = ((String) rsRLoc.elementAt(CERO));
            }
        }
        int i = 0;
        for (char v : seed.toCharArray()) {
            keyValue[i] = (byte) v;
            i++;
        }

    } catch (ClsSqlException exc) {
        LOGGER.error("Error -- KeyValue", exc);
    }
}

--

  • 2
    SQL databases are not appropriate places to store encryption keys. Doubly so when your developers are in the habit of concatenating strings to generate SQL statements instead of using parameterized queries. This is practically begging to have your database's contents dumped and these keys leaked as a result. – Stephen Touset Jan 11 at 20:11
  • That said, your question is not appropriate for here, since at its core it's about a proprietary source linter and only incidentally related to information security. I would ask the vendor themselves, since they're the ones who would provide support for this product. – Stephen Touset Jan 11 at 20:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.