Swift: detect the use of constant passwords for password-based encryption #11063

karimhamdanali · 2022-11-01T12:05:31Z

Deriving password-based encryption keys using hard-coded passwords is insecure, because the generated key may be easily discovered. Data hashed using constant salts are vulnerable to dictionary attacks, enabling attackers to recover the original input.

The rule currently supports all ciphers that the CryptoSwift API provides, but we can always extend it further if more APIs are added.

I'd appreciate a review of the query itself, the accompanying tests, and the associated documentation.

github-actions · 2022-11-01T12:06:43Z

QHelp previews:

swift/ql/src/queries/Security/CWE-259/ConstantPassword.qhelp

Constant password

Deriving password-based encryption keys using hard-coded passwords is insecure, because the generated key may be easily discovered. Data hashed using constant salts are vulnerable to dictionary attacks, enabling attackers to recover the original input.

Recommendation

Use randomly generated passwords to securely derive a password-based encryption key.

Example

The following example shows a few cases of hashing input data. In the 'BAD' cases, the password is constant, making the derived key vulnerable to dictionary attakcs. In the 'GOOD' cases, the password is randomly generated, which protects the hashed data against recovery.


func encrypt(padding : Padding) {
	// ...

	// BAD: Using constant passwords for hashing
	let password: Array<UInt8> = [0x2a, 0x3a, 0x80, 0x05]
	let randomArray = (0..<10).map({ _ in UInt8.random(in: 0...UInt8.max) })
	_ = try HKDF(password: password, salt: randomArray, info: randomArray, keyLength: 0, variant: Variant.sha2)
	_ = try PKCS5.PBKDF1(password: password, salt: randomArray, iterations: 120120, keyLength: 0)
	_ = try PKCS5.PBKDF2(password: password, salt: randomArray, iterations: 120120, keyLength: 0)
	_ = try Scrypt(password: password, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1)

	// GOOD: Using randomly generated passwords for hashing
	let password = (0..<10).map({ _ in UInt8.random(in: 0...UInt8.max) })
	let randomArray = (0..<10).map({ _ in UInt8.random(in: 0...UInt8.max) })
	_ = try HKDF(password: password, salt: randomArray, info: randomArray, keyLength: 0, variant: Variant.sha2)
	_ = try PKCS5.PBKDF1(password: password, salt: randomArray, iterations: 120120, keyLength: 0)
	_ = try PKCS5.PBKDF2(password: password, salt: randomArray, iterations: 120120, keyLength: 0)
	_ = try Scrypt(password: password, salt: randomArray, dkLen: 64, N: 16384, r: 8, p: 1)

	// ...
}

References

What are Salted Passwords and Password Hashing?
Common Weakness Enumeration: CWE-259.

geoffw0

The query looks good, though like #10993 I believe we should have an issue to expand coverage to other libraries / APIs in future. The documentation is currently a little bit confusing, I think just because bits are left over from the other query.

swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql

geoffw0 · 2022-11-01T13:48:45Z

swift/ql/src/queries/Security/CWE-259/ConstantPassword.qhelp

+  "qhelp.dtd">
+<qhelp>
+  <overview>
+    <p>Deriving password-based encryption keys using hard-coded passwords is insecure, because the generated key may be easily discovered. Data hashed using constant salts are vulnerable to dictionary attacks, enabling attackers to recover the original input.</p>


This sentence appears to be about constant salts and needs updating to be about passwords. The query @description claims the issue is about the password being recoverable from the source code (i.e. security through obscurity), though perhaps dictionary and other attacks become feasible with a constant password as well?

I actually modified the description compared to the query about salts to make it more specific to passwords, but perhaps my initial attempt wasn't good enough. I would like to actually differentiate between two scenarios:

using a constant password for password-based encryption key derivation (which this query is about)

hardcoding credentials (e.g., keys, passwords, user names).

The latter is more about CWE-798, and I think that's what you meant by recovering from the source code. On the other hand, this query is just about detecting the use of constant passwords to derive keys used for encryption. That's why this query is just checking that this info is not a constant value.

My conclusion from this discussion (and also while writing the query) is that we perhaps need another query for CWE-798 that checks for those hardcoded credentials.

In that case perhaps the query @description needs updating, as that's where the reference "potential attackers can easily recover them from the source code" comes from.

On hardcoded credentials, we have queries like cs/hardcoded-credentials (not ported to Swift as yet) for this but also rely on secret scanning (which is separate from codeql) for textually recognizable things like AWS keys (regardless of whether they're in source code or not).

(I've now added a row about a cs/hardcoded-credentials-like query to the query prioritization board, I would welcome your thoughts on prioritizing it and which kinds of credentials it should cover)

I'm still not sure I understand what is being said about salts and dictionary attacks - doesn't a constant password for key derivation enable more straightforward attacks than dictionary attacks?

geoffw0 · 2022-11-01T13:48:45Z

swift/ql/src/queries/Security/CWE-259/ConstantPassword.qhelp

+  </example>
+
+  <references>
+    <li><a href="https://www.okta.com/blog/2019/03/what-are-salted-passwords-and-password-hashing/">What are Salted Passwords and Password Hashing?</a></li>


I wonder if we can find a reference specifically about constant passwords?

This RFC is more about the process where these passwords are stored. Do you think it might be more appropriate here?

That looks like a good reference. No harm in having both if both are relevant.

add a query that detects the use of constant passwords

fe408cf

karimhamdanali requested a review from a team as a code owner Nov 1, 2022

github-actions bot added documentation Swift labels Nov 1, 2022

geoffw0 reviewed Nov 1, 2022

View changes

fix typos

8be4d47

Swift: detect the use of constant passwords for password-based encryption #11063

Swift: detect the use of constant passwords for password-based encryption #11063

karimhamdanali commented Nov 1, 2022

github-actions bot commented Nov 1, 2022

Constant password

Recommendation

Example

References

geoffw0 left a comment

geoffw0 Nov 1, 2022

karimhamdanali Nov 1, 2022

geoffw0 Nov 2, 2022 •

edited

geoffw0 Nov 2, 2022

geoffw0 Nov 2, 2022

geoffw0 Nov 1, 2022

karimhamdanali Nov 1, 2022

geoffw0 Nov 2, 2022

Swift: detect the use of constant passwords for password-based encryption #11063

Are you sure you want to change the base?

Swift: detect the use of constant passwords for password-based encryption #11063

Conversation

karimhamdanali commented Nov 1, 2022

github-actions bot commented Nov 1, 2022

Constant password

Recommendation

Example

References

geoffw0 left a comment

geoffw0 Nov 1, 2022

Choose a reason for hiding this comment

karimhamdanali Nov 1, 2022

Choose a reason for hiding this comment

geoffw0 Nov 2, 2022 • edited

Choose a reason for hiding this comment

geoffw0 Nov 2, 2022

Choose a reason for hiding this comment

geoffw0 Nov 2, 2022

Choose a reason for hiding this comment

geoffw0 Nov 1, 2022

Choose a reason for hiding this comment

karimhamdanali Nov 1, 2022

Choose a reason for hiding this comment

geoffw0 Nov 2, 2022

Choose a reason for hiding this comment

geoffw0 Nov 2, 2022 •

edited