<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 9/15/22 4:52 PM, Jeremy Karlson
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:AFEA4073-6453-42A1-8D10-28FBF359350D@gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div><br>
<div>I took a look at the report again, trying to see if there
was any more detail in regards to why it flagged that line.
Nothing, unfortunately.</div>
</div>
</blockquote>
<p><br>
</p>
<p>Bummer. If the report can't provide more detail, then the only
other thing I can think of is: Is there somewhere a list of the
crypto algorithms that Veracode considers weak and that would
trigger the CWE ID 327? If so, then we could probably
cross-reference to the list of EC named curves we support by
default and see if there is an intersection.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:AFEA4073-6453-42A1-8D10-28FBF359350D@gmail.com">
<div><br>
<div>I assume this code is used when there is some sort of
negotiation between systems? (I don’t know much about SAML
here.) Assuming that’s the case, I think there is really
nothing much to do here.</div>
</div>
<br class="">
</blockquote>
<p><br>
</p>
<p>Well, if my speculation is correct, this seems to be flagging on
the fundamental creation of EC key pairs with a particular named
curve. So it's really about the underlying
parameters/characteristics of the EC keys themselves.</p>
<p>Beyond that, EC keys are then used with the fundamental crypto
operations of signing (ECDSA) and encryption (ECDH) over SAML
protocol messages and/or data within them. I wouldn't
characterize those as "negotiation" between systems, because there
isn't a back-and-forth kind of exchange, it's one-sided really
(unlike say TLS). But these fundamental crypto ops are used to
secure the messages and data exchanged between SAML entities,
which for standard Web SSO use cases is primarily Identity
Providers and Service Providers.<br>
</p>
</body>
</html>