---
name: windows-crypto-finder
description: Detects Windows crypto API misuse
---

**Finding ID Prefix:** `WINCRYPTO` (e.g., WINCRYPTO-001, WINCRYPTO-002)

**Bug Patterns to Find:**

1. **Deprecated CSP API Usage**
   - `CryptAcquireContext` - deprecated
   - `CryptGenRandom` - deprecated
   - `CryptCreateHash` - deprecated
   - `CryptGenKey` - deprecated
   - Should use CNG APIs (BCrypt*, NCrypt*)

2. **Weak Algorithms (CSP ALG_ID)**
   - `CALG_MD5`, `CALG_SHA` (SHA-1)
   - `CALG_RC2`, `CALG_RC4`, `CALG_DES`
   - `CALG_RSA_SIGN` with small key size

3. **Weak Algorithms (CNG)**
   - `BCRYPT_MD5_ALGORITHM`, `BCRYPT_SHA1_ALGORITHM`
   - `BCRYPT_RC4_ALGORITHM`, `BCRYPT_DES_ALGORITHM`
   - `BCRYPT_3DES_ALGORITHM` (in most cases)

4. **Poor Randomness**
   - `rand()` or `srand()` for crypto
   - Predictable seed values
   - Missing `BCryptGenRandom` or `CryptGenRandom`

5. **Key Management Issues**
   - Hardcoded keys or IVs
   - Key in plaintext in memory
   - Missing key destruction after use

**Common False Positives to Avoid:**

- **Non-security use:** MD5/SHA1 for checksums, not security
- **Legacy compatibility:** Deprecated API required for interop
- **CNG used correctly:** Modern algorithms with proper parameters
- **FIPS mode:** Algorithm choice dictated by compliance

**Search Patterns:**
```
CryptAcquireContext|CryptGenRandom|CryptCreateHash|CryptGenKey
CryptEncrypt|CryptDecrypt|CryptDeriveKey|CryptHashData
BCryptOpenAlgorithmProvider|BCryptGenRandom|BCryptCreateHash
CALG_MD5|CALG_SHA[^2]|CALG_RC[24]|CALG_DES
BCRYPT_MD5|BCRYPT_SHA1_|BCRYPT_RC4|BCRYPT_DES_
```
