VNX-326: Inadequate Encryption Strength (undersized DSA, DH, EC or symmetric key)

Field	Value
Rule ID	VNX-326
Severity	High
SARIF level	error
Kind	sast
Languages	Go, Java, Kotlin, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-326
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	crypto key-size cwe-326
Source	internal/sast/rules/vnx-326.rego

Overview

VNX-326 maps to CWE-326: Inadequate Encryption Strength. It reports key generation with a literal size or named parameter set below current minimums.

Why This Matters

A 1024-bit DSA or Diffie-Hellman group is within reach of a well-funded attacker (Logjam precomputed the common 512 and 1024-bit groups), and curves under 224 bits give less than 112 bits of security. NIST SP 800-131A disallows both for new keys.

What Gets Flagged

// FLAGGED: a DSA generator initialised below 2048 bits
KeyPairGenerator g = KeyPairGenerator.getInstance("DSA");
g.initialize(1024);
// FLAGGED: a 192-bit curve
g.initialize(new ECGenParameterSpec("secp192r1"));

# FLAGGED
dsa.generate_private_key(key_size=1024)
dh.generate_parameters(generator=2, key_size=512)
ec.generate_private_key(ec.SECP192R1())

// FLAGGED
dsa.GenerateParameters(&params, rand.Reader, dsa.L1024N160)

// FLAGGED
crypto.generateKeyPairSync('dsa', { modulusLength: 1024 });
crypto.getDiffieHellman('modp2');

// FLAGGED
openssl_pkey_new(['private_key_bits' => 1024]);

# FLAGGED
OpenSSL::PKey::RSA.new(1024)

What Is Not Flagged

• Sizes of 2048 bits and above (128 bits and above for AES), and sizes from a variable or configuration.
• init()/initialize() on objects that are not a DSA/DH key-pair generator or an AES key generator.
• RSA in Python, Go, Java and Node.js, which VNX-CRYPTO-006 reports; broken ciphers such as DES and RC4, which VNX-CRYPTO-004 reports.
• Comments, string literals and test files.

Remediation

1. Use 3072-bit DSA, DH or RSA keys, or move to elliptic curves (P-256, X25519, Ed25519).
2. Use AES-128 or AES-256 keys.
3. Use modp14 (2048-bit) or larger groups, or ECDH.

References

• CWE-326: Inadequate Encryption Strength
• NIST SP 800-131A Rev. 2

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-326
// nosec vnx-326

Or record an ignore rule: vulnetix ignore add --rule vnx-326 --reason "...". See Suppressing findings.