CXX.SV.PRIVATE_KEY.EMPTY_PASSWD

Attempt to serialize private key in an unauthorized way

Klocwork reports a CXX.SV.PRIVATE_KEY.EMPTY_PASSWD defect when an empty password is used to store a private key in a public key infrastructure (PKI) based authentication, which can lead to unauthorized access.

Vulnerability and risk

If a private key is stolen, this can compromise the authentication gained through PKI because an attacker can use the private key to digitally sign documents and pretend to be the authorized user.

Mitigation and prevention

We recommend using encryption techniques such as cipher or a non-empty password.

Vulnerable code example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
#include <QOpcUaProvider>
#include <QOpcUaKeyPair>
#include <QFile>
int main()
{
    // Generate RSA Key
    QOpcUaKeyPair key;
    key.generateRsaKey(QOpcUaKeyPair::RsaKeyStrength::Bits1024);

    // Save private key to file
    QByteArray keyData = key.privateKeyToByteArray(QOpcUaKeyPair::Cipher::Aes128Cbc, "");

    QFile keyFile("privateKey.pem");
    keyFile.open(QFile::WriteOnly);
    keyFile.write(keyData);
    keyFile.close();
  }

Klocwork reports a CXX.SV.PRIVATE_KEY.EMPTY_PASSWD defect on line 11, indicating, “Attempt to serialize private key in an unauthorized way. Consider encrypting with non-empty password.” In the QOpcUaKeyPair::privateKeyToByteArray method, an empty password is passed which means private key is stored with empty password and is prone to unauthorized access.

Fixed code example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
#include <QOpcUaProvider>
#include <QOpcUaKeyPair>
#include <QFile>
int main()
{
    // Generate RSA Key
    QOpcUaKeyPair key;
    key.generateRsaKey(QOpcUaKeyPair::RsaKeyStrength::Bits1024);
    QByteArray keyData = key.privateKeyToByteArray(QOpcUaKeyPair::Cipher::Aes128Cbc, "K016w81");

    QFile keyFile("privateKey.pem");
    keyFile.open(QFile::WriteOnly);
    keyFile.write(keyData);
    keyFile.close();
  }

Klocwork no longer reports a CXX.SV.PRIVATE_KEY.EMPTY_PASSWD defect because a password (“K016w81”) has been used on private key for required encryption.

Related checkers

• CXX.SV.PRIVATE_KEY.UNENCRYPTED

External guidance

• CWE-311: Missing Encryption of Sensitive Data
• CWE-312: Cleartext Storage of Sensitive Information
• CWE-522: Insufficiently Protected Credentials
• DISA STIG version 4 and 5
• OWASP A2:2021 Cryptographic Failures
• STIG-ID:V-222551 (APSC-DV-001820): The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.

Security training

Application security training materials provided by Secure Code Warrior.

• Plaintext Storage Of Sensitive Data Training Video - Test your skills with a training example
• Insufficiently Protected Credentials Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis and the PK.EMPTY_PWD.SINK knowledge base for more information.