CWE ID 327: AbstractNamedCurve.java:94

[Jeremy Karlson]

Hi everyone. I’m new here, so I apologize if this has been discussed ad nauseam before. (I did try searching for answers, but didn’t fine clarity for this specific file.)

Veracode (a code scanning tool my employer has recently started using) is reporting CWE ID 27 (Use of a Broken or Risky Cryptographic Algorithm) specifically in opensaml-security-api, org.opensaml.security.crypto.ec.curves.AbstractNamedCurve.java, line 94. This method is:

   @Nullable protected ECParameterSpec buildParameterSpec()

And the line in question is:

   jcaSpec = ECPublicKey.class.cast(
      KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(getName()), null)
         .getPublic()).getParams();

I looked at the code but I am certainly out of my depth here, as I know very little about how this operates internally. I am certain this has been brought up and considered before, so if someone wants to let me know this isn’t a problem, I can put a checkmark in this box and we can all get on with out days. :-)

Thanks for your time.

Jeremy