This rule is deprecated; use {rule:csharpsquid:S4426}, {rule:csharpsquid:S5542}, {rule:csharpsquid:S5547} instead.

Encrypting data is security-sensitive. It has led in the past to the following vulnerabilities:

Proper encryption requires both the encryption algorithm and the key to be strong. Obviously the private key needs to remain secret and be renewed regularly. However these are not the only means to defeat or weaken an encryption.

This rule flags function calls that initiate encryption/decryption.

Ask Yourself Whether

You are at risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

Sensitive Code Example

using System;
using System.Security.Cryptography;

namespace MyNamespace
{
    public class MyClass
    {
        public void Main()
        {
            Byte[] data = {1,1,1};

            RSA myRSA = RSA.Create();
            RSAEncryptionPadding padding = RSAEncryptionPadding.CreateOaep(HashAlgorithmName.SHA1);
            // Review all base RSA class' Encrypt/Decrypt calls
            myRSA.Encrypt(data, padding); // Sensitive
            myRSA.EncryptValue(data); // Sensitive
            myRSA.Decrypt(data, padding); // Sensitive
            myRSA.DecryptValue(data); // Sensitive

            RSACryptoServiceProvider myRSAC = new RSACryptoServiceProvider();
            // Review the use of any TryEncrypt/TryDecrypt and specific Encrypt/Decrypt of RSA subclasses.
            myRSAC.Encrypt(data, false); // Sensitive
            myRSAC.Decrypt(data, false); // Sensitive
            int written;
            myRSAC.TryEncrypt(data, Span<byte>.Empty, padding, out written); // Sensitive
            myRSAC.TryDecrypt(data, Span<byte>.Empty, padding, out written); // Sensitive

            byte[] rgbKey = {1,2,3};
            byte[] rgbIV = {4,5,6};
            SymmetricAlgorithm rijn = SymmetricAlgorithm.Create();
            // Review the creation of Encryptors from any SymmetricAlgorithm instance.
            rijn.CreateEncryptor(); // Sensitive
            rijn.CreateEncryptor(rgbKey, rgbIV); // Sensitive
            rijn.CreateDecryptor(); // Sensitive
            rijn.CreateDecryptor(rgbKey, rgbIV); // Sensitive
        }

        public class MyCrypto : System.Security.Cryptography.AsymmetricAlgorithm // Sensitive
        {
            // ...
        }

        public class MyCrypto2 : System.Security.Cryptography.SymmetricAlgorithm // Sensitive
        {
            // ...
        }
    }
}

See