Suggestion: add rule/warning for use of weak security algorithms?

It might be worth adding a rule which checks for the System.Security.Cryptography namespace use of MD5 and weaker, and maybe SHA1 hashes (HashAlgorithm), and DES, TripleDES and weaker encryption (SymmetricAlgorithm), with a recommendation to use SHA256, or higher, and Rijndael [AES] instead.

See the following article, which apparently reports on Microsoft internal guidelines.

http://www.eweek.com/article2/0,1759,1859751,00.asp

Of course, this rule would be best for new systems, where you get to choose the encryption level. The doco should have a clear exclusion point -- where you need to interoperate with an existing security system.

Answer this question

Suggestion: add rule/warning for use of weak security algorithms?

troptommy
Great suggestion, thanks for the post. I've entered this in our database and will contact Mike Howard about the idea.
Suggestion: add rule/warning for use of weak security algorithms?

Answer this question