High severityGoCryptographyHIGH confidence
Weak Cipher DES RC4
DES, 3DES, and RC4 are obsolete and insecure ciphers (CWE-327/CWE-326).
Standards mapping
- OWASP Top 10
- A02:2021 - Cryptographic Failures
- OWASP ASVS
- V6.2.2 (L2)
Vulnerable vs. safe
Flagged by this check
_, _ = des.NewCipher(key)Passes - the safe pattern
_, _ = cipher.NewGCM(block)Why it matters & how to fix it
DES, 3DES, and RC4 are obsolete and insecure ciphers (CWE-327/CWE-326). DES/3DES have inadequate key/block strength and RC4 has practical plaintext-recovery attacks. Use AES-256 in an authenticated mode (crypto/cipher AEAD such as GCM, or golang.org/x/crypto/chacha20poly1305) with a unique random nonce per message.
References
Rule ID integsec-go-weak-cipher-des-rc4 - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - CryptographyInsecure Randomness For Secrets
- JavaScript / TypeScript - CryptographyWeak Cipher Algorithm
- JavaScript / TypeScript - CryptographyWeak Hash Algorithm
- Python - CryptographyInsecure Random Token
- Python - CryptographyWeak Cipher DES ECB
- Python - CryptographyWeak Hash MD5 SHA1