
    >/i                         S r SSKrSSKJr  SSKJr  S rS rS rS r	\R                  \R                  " S	5      \R                  " S
5      S 5       5       5       rg)au  
=========================================
B505: Test for weak cryptographic key use
=========================================

As computational power increases, so does the ability to break ciphers with
smaller key lengths. The recommended key length size for RSA and DSA algorithms
is 2048 and higher. 1024 bits and below are now considered breakable. EC key
length sizes are recommended to be 224 and higher with 160 and below considered
breakable. This plugin test checks for use of any key less than those limits
and returns a high severity error if lower than the lower threshold and a
medium severity error for those lower than the higher threshold.

:Example:

.. code-block:: none

    >> Issue: DSA key sizes below 1024 bits are considered breakable.
       Severity: High   Confidence: High
       CWE: CWE-326 (https://cwe.mitre.org/data/definitions/326.html)
       Location: examples/weak_cryptographic_key_sizes.py:36
    35  # Also incorrect: without keyword args
    36  dsa.generate_private_key(512,
    37                           backends.default_backend())
    38  rsa.generate_private_key(3,

.. seealso::

 - https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
 - https://security.openstack.org/guidelines/dg_strong-crypto.html
 - https://cwe.mitre.org/data/definitions/326.html

.. versionadded:: 0.14.0

.. versionchanged:: 1.7.3
    CWE information added

    N)issue)test_propertiesc                 "    U S:X  a	  SSSSSSS.$ g )Nweak_cryptographic_keyi            )weak_key_size_dsa_highweak_key_size_dsa_mediumweak_key_size_rsa_highweak_key_size_rsa_mediumweak_key_size_ec_highweak_key_size_ec_medium )names    _/home/james-whalen/.local/lib/python3.13/site-packages/bandit/plugins/weak_cryptographic_key.py
gen_configr   /   s,    ''&*(,&*(,%('*
 	
 (    c           	         [        U[        5      (       a  g U S   [        R                  4U S   [        R                  4/U S   [        R                  4U S   [        R                  4/U S   [        R                  4U S   [        R                  4/S.nX1    HM  u  pEX$:  d  M  [        R
                  " U[        R                  [        R                  R                  SX4-  S	9s  $    g )
Nr
   r   r   r   r   r   DSARSAECz5%s key sizes below %d bits are considered breakable. )severity
confidencecwetext)	
isinstancestrbanditHIGHMEDIUMIssuer   CweINADEQUATE_ENCRYPTION_STRENGTH)configkey_typekey_size	key_sizessizelevels         r   _classify_key_sizer,   ;   s    (C   ,-v{{;./?

 ,-v{{;./?

 +,fkk:-.>
I !*?<<!;;II<<L"#	  +r   c                     SSSS.nSSSS.nUR                  U R                  5      nUS;   a@  U R                  S	5      =(       d    U R                  X4   5      =(       d    S
n[	        XU5      $ US:X  a  0 SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S!_S#S$_S%S&_S'S'S(.EnU R                  S)5      =(       d2    [        U R                  5      X4   :  =(       a    U R                  X4      nXv;   a  Xg   OS$n[	        XU5      $ g )*Nr   r   r   )zBcryptography.hazmat.primitives.asymmetric.dsa.generate_private_keyzBcryptography.hazmat.primitives.asymmetric.rsa.generate_private_keyzAcryptography.hazmat.primitives.asymmetric.ec.generate_private_keyr      r   )r   r   r(   r   	SECT571K1i;  	SECT571R1i:  	SECP521R1i	  BrainpoolP512R1i   	SECT409K1i  	SECT409R1BrainpoolP384R1i  	SECP384R1	SECT283K1i  	SECT283R1BrainpoolP256R1   	SECP256K1	SECP256R1	SECT233K1   	SECT233R1	SECP224R1r	   	SECP192R1      )	SECT163K1	SECT163R2curve)getcall_function_name_qualget_call_arg_valueget_call_arg_at_positionr,   len	call_args)contextr&   func_key_typearg_positionr'   r(   curve_key_sizesrF   s           r   %_weak_crypto_key_size_cryptography_iorQ   Z   s    !& % $M L
   !@!@AH>!&&z2 //0FG 	
 "&H==	T	


 
 s	

 
 
 s
 
 
 
 s
 
 
 
 
  !
" #
$ '
* **73 
!!"\%;; :!!,"89 	 .3-E?)3!&H==7 
r   c                     SSSSS.nUR                  U R                  5      nU(       a>  U R                  S5      =(       d    U R                  S5      =(       d    Sn[	        XU5      $ g )Nr   r   )zCrypto.PublicKey.DSA.generatezCrypto.PublicKey.RSA.generatez!Cryptodome.PublicKey.DSA.generatez!Cryptodome.PublicKey.RSA.generatebitsr   r   )rG   rH   rI   rJ   r,   )rM   r&   rN   r'   r(   s        r   _weak_crypto_key_size_pycryptorT      sr    ).).-2-2	M   !@!@AH&&v. //2 	
 "&H== r   CallB505c                 <    [        X5      =(       d    [        X5      $ )N)rQ   rT   )rM   r&   s     r   r   r      s!     1 9	'	89r   )__doc__r    bandit.corer   r   testr   r,   rQ   rT   takes_configcheckstest_idr   r   r   r   <module>r^      sg   %L   /	
>1>h>" Vf9   9r   