| title | Use of Hardcoded Cryptographic Keys in Code | ||
|---|---|---|---|
| platform | android | ||
| id | MASTG-TEST-0212 | ||
| type |
|
||
| weakness | MASWE-0003 | ||
| profiles |
|
||
| knowledge |
|
In this test case, we will look for the use of hardcoded cryptographic keys in Android applications. Hardcoded key material may be passed to different cryptographic APIs or represented using different key classes and specifications. For example, the Java Cryptography Architecture (JCA) provides several KeySpec implementations and key factory APIs for constructing cryptographic keys from supplied key material.
The use of a key-related API or class, such as SecretKeySpec, does not by itself indicate that a key is hardcoded. The source of the key material must be traced to determine whether it is embedded in the application code.
- Use @MASTG-TECH-0013 to reverse engineer the app.
- Use @MASTG-TECH-0014 to identify cryptographic key construction, import, derivation, or use, and trace the corresponding key material back to its source.
The output should contain a list of locations where cryptographic keys are used together with the source of their key material, identifying any key material that is hardcoded in the application code.
The test case fails if you find any hardcoded cryptographic key material that is used in security-sensitive contexts.