[Security] Fix CodeQL alert #21: Use of a broken or weak cryptographic algorithm

[colin-d-fried]

Summary

Fixes CodeQL alert #21: Use of a broken or weak cryptographic algorithm

Field	Value
Severity	high
File	vulnerable_weak_crypto.py
CWE	CWE-327
Alert	CodeQL Alert #21

Fix Applied

See the diff for the specific secure coding change applied.

Fixes #23

---

Note

Medium Risk
Changes the encryption algorithm and output format for encrypt_sensitive_data, which can break any callers expecting DES block-sized output or needing deterministic encryption; also introduces new key-generation behavior that requires correct key management elsewhere.

Overview
Upgrades encrypt_sensitive_data in vulnerable_weak_crypto.py from a hardcoded-key DES ECB implementation to authenticated encryption using AES-256-GCM with a per-call random key.

The function now returns nonce + tag + ciphertext instead of padded DES ciphertext, changing the binary format and requiring callers to handle nonce/tag and persist the generated key for later decryption.

^{Written by Cursor Bugbot for commit 41e817a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Random encryption key generated but never returned

High Severity

encrypt_sensitive_data generates a random key via get_random_bytes(32) but only returns the nonce, tag, and ciphertext — the key is discarded when the function returns. This means the encrypted data can never be decrypted. The previous (insecure) implementation used a hardcoded key, which at least allowed decryption. The fix swapped a security problem for a complete loss of functionality.

 

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 Encryption key is generated randomly but never returned, making decryption impossible

The new encrypt_sensitive_data function generates a random AES-256 key via get_random_bytes(32) on every call, but the key is never returned or stored. The function only returns cipher.nonce + tag + ciphertext. Without the key, there is no way to decrypt the data, rendering the encryption useless — the data is effectively destroyed. The old code used a hardcoded key (b'weakkey1'), which was insecure but at least allowed decryption. The function should either return the key alongside the ciphertext (e.g., as a tuple) or accept the key as a parameter.

Suggested change

	key = get_random_bytes(32)
	cipher = AES.new(key, AES.MODE_GCM)
	ciphertext, tag = cipher.encrypt_and_digest(data.encode())
	return cipher.nonce + tag + ciphertext
	key = get_random_bytes(32)
	cipher = AES.new(key, AES.MODE_GCM)
	ciphertext, tag = cipher.encrypt_and_digest(data.encode())
	return key, cipher.nonce + tag + ciphertext

---

Was this helpful? React with 👍 or 👎 to provide feedback.