Use of a risky cryptographic algorithm

[thachlp]

Bug Report

Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.

Current Behavior

Input Code

Input Code

    public static String digest(ByteBuffer script) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA1");
            md.update(script);
            return new String(Base16.encode(md.digest(), false));
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("JVM does not support SHA1");
        }
    }

Expected behavior/code

Environment

• Lettuce version(s): [main]

Possible Solution

Using SHA-256 instead

    public static String digest(ByteBuffer script) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-256");
            md.update(script);
            return new String(Base16.encode(md.digest(), false));
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("JVM does not support SHA-256");
        }
    }

Additional context

[tishun]

Hey @thachlp ,

Have you verified that the server supports SHA-256? From the documentation it seems it does not.

[thachlp]

@tishun
Oops, I didn't realize Redis doesn't support SHA-256, I will close this issue. Thanks 🙇

[tishun]

No problem :) thanks for taking a look