Skip to content

Conversation

@cpholguera
Copy link
Collaborator

This pull request updates MASTG-TEST-0210.

Overview

  • Added algorithm examples for CommonCrypto: Added kCCAlgorithmBlowfish to the list of supported algorithms for the CCCrypt function. Clarified that the alg parameter uses constants from the CCAlgorithm enumeration.
  • Third-party library considerations: Documented the potential use of weak encryption algorithms in third-party libraries (e.g., OpenSSL, BoringSSL, Libsodium) and custom implementations.

Evaluation

  • Additional weak algorithm: Included Blowfish in the list of weak encryption algorithms that cause the test case to fail.
  • Broader applicability: Extended the scope of the test case to include weak algorithms used in Apple APIs, third-party libraries, and custom cryptographic routines, with examples of insecure configurations (e.g., ECB mode, short key sizes).

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances the MASTG-TEST-0210 documentation by adding Blowfish to both the CommonCrypto example and the list of weak algorithms, and by highlighting third-party or custom crypto implementations.

  • Added kCCAlgorithmBlowfish to the CommonCrypto CCCrypt algorithm list
  • Clarified CryptoKit supported algorithms wording
  • Documented third-party/custom library considerations and updated the failure list to include Blowfish
Comments suppressed due to low confidence (1)

tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0210.md:46

  • [nitpick] This paragraph largely duplicates the third-party library bullet above. Consider merging or rephrasing to avoid redundancy, and add a period at the end for consistency.
This applies to Apple-provided APIs (e.g., CommonCrypto), third-party libraries (e.g., OpenSSL, Libsodium) and any custom implementations of cryptographic routines that replicate insecure algorithms (e.g., DES in C code) or use insecure configurations (e.g., ECB mode, short key sizes) 

@cpholguera cpholguera marked this pull request as ready for review July 17, 2025 05:46
@cpholguera cpholguera requested a review from TheDauntless July 17, 2025 05:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants