# V5315\. OWASP\. Use of an outdated cryptographic algorithm is not recommended\.

The analyzer has detected that the application uses an outdated cryptographic algorithm\. The use of such algorithms can lead to sensitive data exposure, key leakage, broken authentication, etc\.

Vulnerabilities related to the use of weak cryptographic algorithms can be categorized under the [OWASP Top 10 2021](https://owasp.org/Top10/) as follows:

* [A2: Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)

Look at the following example:

```cpp
public void encryptData(String data, SecretKey secretKey) {
    Cipher cipher = null;
    try {
        cipher = Cipher.getInstance("DES");         // <=
    } catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
        // ....
    }

    try {
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);
    } catch (InvalidKeyException e) {
        // ....
    }

    try {
        byte[] encryptedData = cipher.doFinal(data.getBytes());
    } catch (IllegalBlockSizeException | BadPaddingException e) {
        // ....
    }

    // ....
}
```

When analyzing the code fragment, the analyzer will warn against using DES\.

It is better to use modern algorithms instead of outdated ones\. In the example above, one possible solution is to replace DES with AES:

```cpp
public void encryptData(String data, SecretKey secretKey) {
    Cipher cipher = null;
    try {
        cipher = Cipher.getInstance("AES/CBC/NoPadding");
    } catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
        // ....
    }

    try {
        cipher.init(Cipher.ENCRYPT_MODE, secretKey);
    } catch (InvalidKeyException e) {
        // ....
    }

    try {
        byte[] encryptedData = cipher.doFinal(data.getBytes());
    } catch (IllegalBlockSizeException | BadPaddingException e) {
        // ....
    }

    // ....
}
```

[Oracle's website](https://docs.oracle.com/en/java/javase/21/docs/specs/security/standard-names.html#cipher-algorithms) provides documentation on standard implementations of various cryptographic algorithms\. The following is a list of some algorithms that are not recommended for use:

* DES
* DESede
* RC2
* RC4
* RC5
* Blowfish

For example, the recommendation to use the aforementioned [Data Encryption Standard](https://csrc.nist.gov/pubs/fips/46-3/final) \(DES\) was [withdrawn](https://csrc.nist.gov/files/pubs/fips/46-3/final/docs/fips46-3.pdf) in 2005 and replaced with the [Advanced Encryption Standard](https://csrc.nist.gov/pubs/fips/197/final) \(AES\)\.

The official OWASP website [provides](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/04-Testing_for_Weak_Encryption) various techniques for testing applications for potential vulnerabilities caused by the use of weak cryptographic algorithms\.