Add EC to secure algorithm whitelist for Java CWE-327 query

Author: MarkLee131

java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`) as potentially insecure. These are modern, secure algorithms recommended by NIST SP 800-57 and other standards bodies. Previously, these algorithms were not included in the secure algorithm whitelist, causing false positives when using standard Java cryptographic APIs such as `KeyPairGenerator.getInstance("EC")`.

java/ql/lib/semmle/code/java/security/Encryption.qll

@@ -259,7 +259,11 @@ string getASecureAlgorithmName() {
   result =
     [
       "RSA", "SHA-?(256|384|512)", "CCM", "GCM", "AES(?![^a-zA-Z](ECB|CBC/PKCS[57]Padding))",
-      "Blowfish", "ECIES", "SHA3-(256|384|512)"
+      "Blowfish", "ECIES", "SHA3-(256|384|512)",
+      // Elliptic Curve algorithms: EC (key generation), ECDSA (signatures), ECDH (key agreement),
+      // EdDSA/Ed25519/Ed448 (Edwards-curve signatures), XDH/X25519/X448 (key agreement).
+      // These are modern, secure algorithms recommended by NIST and other standards bodies.
+      "EC", "ECDSA", "ECDH", "EdDSA", "Ed25519", "Ed448", "XDH", "X25519", "X448"
     ]
 }
 

java/ql/test/query-tests/security/CWE-327/semmle/tests/Test.java

@@ -46,6 +46,39 @@ public void test() {
 			cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
 
 			byte[] encrypted = cipher.doFinal(input.getBytes("UTF-8"));
+
+			KeyPairGenerator keyPairGenerator;
+
+			// GOOD: EC is a secure algorithm for key pair generation
+			keyPairGenerator = KeyPairGenerator.getInstance("EC");
+
+			// GOOD: ECDSA is a secure algorithm for digital signatures
+			Signature ecdsaSig = Signature.getInstance("ECDSA");
+
+			// GOOD: ECDH is a secure algorithm for key agreement
+			KeyAgreement ecdhKa = KeyAgreement.getInstance("ECDH");
+
+			// GOOD: EdDSA is a secure algorithm (Edwards-curve Digital Signature Algorithm)
+			keyPairGenerator = KeyPairGenerator.getInstance("EdDSA");
+
+			// GOOD: Ed25519 is a secure algorithm
+			keyPairGenerator = KeyPairGenerator.getInstance("Ed25519");
+
+			// GOOD: Ed448 is a secure algorithm
+			keyPairGenerator = KeyPairGenerator.getInstance("Ed448");
+
+			// GOOD: XDH is a secure algorithm for key agreement
+			keyPairGenerator = KeyPairGenerator.getInstance("XDH");
+
+			// GOOD: X25519 is a secure algorithm for key agreement
+			keyPairGenerator = KeyPairGenerator.getInstance("X25519");
+
+			// GOOD: X448 is a secure algorithm for key agreement
+			keyPairGenerator = KeyPairGenerator.getInstance("X448");
+
+			// GOOD: SHA256withECDSA is a secure signature algorithm
+			Signature sha256Ecdsa = Signature.getInstance("SHA256withECDSA");
+
 		} catch (Exception e) {
 			// fail
 		}