Skip to content

suspicious-insecure-cipher-mode-usage (S305)

Derived from the flake8-bandit linter.

What it does

Checks for uses of weak or broken cryptographic cipher modes.

Why is this bad?

Weak or broken cryptographic ciphers may be susceptible to attacks that allow an attacker to decrypt ciphertext without knowing the key or otherwise compromise the security of the cipher, such as forgeries.

Use strong, modern cryptographic ciphers instead of weak or broken ones.

Example

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

algorithm = algorithms.ARC4(key)
cipher = Cipher(algorithm, mode=modes.ECB(iv))
encryptor = cipher.encryptor()

Use instead:

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

algorithm = algorithms.ARC4(key)
cipher = Cipher(algorithm, mode=modes.CTR(iv))
encryptor = cipher.encryptor()

References