codeql
codeql copied to clipboard
Swift: check for using ECB encryption mode
ECB should never be used as a mode for encryption. This mode encrypts data the same way every time (i.e., same plaintext will produce the same ciphertext). This behaviour makes encrypted messages vulnerable to replay attacks.
The rule currently supports using that mode of encryption with AES and Blowfish (the two supported ciphers in the CryptoSwift API), but we can always extend it further if more APIs show up.
I'd appreciate a review of the query itself, the accompanying tests, and the associated documentation.