Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend says "The ciphertext produced is susceptible to alteration by an adversary. This mean that the cipher provides no way to detect that the data has been tampered with. If the ciphertext can be controlled by an attacker, it could be altered without detection."

For the solution it suggests to "Use a cipher that includes a Hash based Message Authentication Code (HMAC) to sign the data. Combining a HMAC function to the existing cipher is prone to error. Specifically, it is always recommended that you be able to verify the HMAC first, and only if the data is unmodified, do you then perform any cryptographic functions on the data." Examples at http://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY

My statement is like below

Cipher engine = Cipher.getInstance("PBEWithMD5AndDES");

Doesn't the "PBEWithMD5AndDES" option verify the HMAC first? Or should I use other cipher option like "AES/GCM/NoPadding" as suggested?

share|improve this question
    
MD5/DES sounds like something that went out of style 15 years ago – Richie Frame Dec 21 '15 at 20:51
up vote 3 down vote accepted

Password-based encryption uses a hash function to derive a key from a password and that is the only use of a hash function. PBEWithMD5AndDES itself doesn't provide any authentication (includes integrity) and only uses MD5 for key derivation.

If you want authentication, then you can still use PBEWithMD5AndDES, but you then would have to derive a MAC key from the password yourself and generate an authentication tag by running HMAC(ciphertext, macKey).

But it is not recommended to use DES or even MD5 nowadays, so you should change the encryption scheme nevertheless. If you do, then you can exchange it with AES-GCM which already provides authentication. You still would need to derive a key from a password that you provide. There are many key-derivation functions, but Java provides PBKDF2 in the standard library. Alternatives are scrypt, bcrypt and Argon2.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.