[Security] Fix CodeQL alert #19: Use of a broken or weak cryptographic algorithm

[colin-d-fried]

Summary

Fixes CodeQL alert #19: Use of a broken or weak cryptographic algorithm

Field	Value
Severity	high
File	vulnerable_weak_crypto.py
CWE	CWE-327
Alert	CodeQL Alert #19

Fix Applied

See the diff for the specific secure coding change applied.

Fixes #21

---

Note

Medium Risk
Changes cryptography behavior and the ciphertext output format, which may break any downstream consumers expecting raw DES-ECB blocks. Security risk is reduced, but integration/regression risk exists where this function’s output is parsed or stored.

Overview
Updates encrypt_data_des in vulnerable_weak_crypto.py to stop using DES in ECB mode and instead encrypt using AES-GCM with encrypt_and_digest.

The function now returns a single byte string composed of nonce + tag + ciphertext, changing both the algorithm and the serialized output format for callers.

^{Written by Cursor Bugbot for commit 7ddb89d. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Function name misleadingly references DES despite using AES

Medium Severity

The function encrypt_data_des was changed to use AES.MODE_GCM internally, but the function name still says "des." This creates a misleading API contract — callers expect DES (8-byte key) but get AES (16/24/32-byte key), so any existing caller passing a DES-sized key will receive a runtime error. The return format also changed from raw ciphertext to nonce + tag + ciphertext with no update to the function name or signature to signal these breaking changes.