Skip to content

MASTG-TEST-0212: Clarify test case for hardcoded cryptographic keys #3945

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cpholguera wants to merge 3 commits into
base: master
Choose a base branch
from
Open

MASTG-TEST-0212: Clarify test case for hardcoded cryptographic keys #3945

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6ac1c4
MASTG-TEST-0212: Clarify test case for hardcoded cryptographic keys
cpholguera Sep 1, 2026
eb54f3c
Apply suggestion from @cpholguera
cpholguera Sep 1, 2026
340d9fb
Apply suggestion from @cpholguera
cpholguera Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0212.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,19 @@ knowledge: [MASTG-KNOW-0012]

## Overview

In this test case, we will look for the use of hardcoded keys in Android applications. To do this, we need to focus on the cryptographic implementations of hardcoded keys. The Java Cryptography Architecture (JCA) provides the [`SecretKeySpec`](https://developer.android.com/reference/javax/crypto/spec/SecretKeySpec) class, which allows you to create a [`SecretKey`](https://developer.android.com/reference/javax/crypto/SecretKey) from a byte array.
In this test case, we will look for the use of hardcoded cryptographic keys in Android applications. Hardcoded key material may be passed to different cryptographic APIs or represented using different key classes and specifications. For example, the Java Cryptography Architecture (JCA) provides several [`KeySpec`](https://developer.android.com/reference/java/security/spec/KeySpec) implementations and key factory APIs for constructing cryptographic keys from supplied key material.

The use of a key-related API or class, such as [`SecretKeySpec`](https://developer.android.com/reference/javax/crypto/spec/SecretKeySpec), does not by itself indicate that a key is hardcoded. The source of the key material must be traced to determine whether it is embedded in the application code.
Comment thread
cpholguera marked this conversation as resolved.
Outdated

## Steps

1. Use @MASTG-TECH-0013 to reverse engineer the app.
2. Use @MASTG-TECH-0014 to look for the relevant APIs.
2. Use @MASTG-TECH-0014 to identify cryptographic key construction, import, derivation, or use, and trace the corresponding key material back to its source.
Comment thread
cpholguera marked this conversation as resolved.
Outdated

## Observation

The output should contain a list of locations where hardcoded keys are used.
The output should contain a list of locations where cryptographic keys are used together with the source of their key material, identifying any key material that is hardcoded in the application code.

## Evaluation

The test case fails if you find any hardcoded keys that are used in security-sensitive contexts.
The test case fails if you find any hardcoded cryptographic key material that is used in security-sensitive contexts.
Loading