Page History

Wiki MarkupSensitive data must be protected from eavesdropping and malicious tampering during transit. An Obfuscated Transfer Object \[[Steel 2005|AA. Bibliography#Steel 05]\] that is strongly encrypted can protect data in exchanges that involve multiple business tiers or end user systems. This approach is known as _sealing_ the object. To guarantee object integrity, apply a digital signature to the sealed object. eavesdropping. All data that crosses a trust boundary must be protected from malicious tampering. An obfuscated transfer object [Steel 2005] that is strongly encrypted can protect data. This approach is known as sealing the object. To guarantee object integrity, apply a digital signature to the sealed object.

Sealing and signing objects is the preferred mechanism to secure data when

• Serializing or transporting sensitive data is necessaryTransporting sensitive data or serializing any data.
• A secure communication channel such as Secure Sockets Layer (SSL) is absent or is too costly for limited transactions.
• Some sensitive Sensitive data must persist over an extended period of time (e.g. on an external for example, on a hard drive).

Avoid using home-brewed cryptographic algorithms; such algorithms will almost certainly introduce unnecessary vulnerabilities. Applications that apply home-brewed "cryptography" in the readObject() and writeObject() methods are prime examples of anti-patterns.

Furthermore, Abadi and Needham have suggested \[[Abadi 1996|AA. Bibliography#Abadi 96]\] a useful principle of secure software design

When a principal signs material that has already been encrypted, it should not be inferred that the principal knows the content of the message. On the other hand, it is proper to infer that the principal that signs a message and then encrypts it for privacy knows the content of the message.

The rationale is that any malicious party can intercept the originally signed encrypted message from the originator, strip the signature and add its own signature to the encrypted message. Both the malicious party, and the receiver have no information about the contents of the original message as it is encrypted and then signed (it can only be decrypted after verifying the signature). The receiver has no way of confirming the sender's identity unless the legitimate sender's public key is obtained over a secure channel. One of the three CCITT X.509 standard protocols was susceptible to such an attack \[[CCITT 1988|AA. Bibliography#CCITT 88]\].  

The subsequent code examples all involve the following code sample. This code sample posits a map that is serializable, as well as a function to populate the map with interesting values, and a function to check the map for those values.

. However, using existing cryptography libraries inside readObject() and writeObject() is perfrectly warranted.

This rule applies to the intentional serialization of sensitive information. SER03-J. Do not serialize unencrypted sensitive data is meant to prevent the unintentional serialization of sensitive information.

Noncompliant Code Example

The code examples for this rule are all based on the following code example:

class SerializableMap<K,V> implements Serializable {
  final static long serialVersionUID = -2648720192864531932L;
  private Map<K,V> map;
  
  public SerializableMap() {
    map = new HashMap<K,V>();
  }

  public Object getData(K key)  {
    return map.get(key);
  }

  public void setData(K key, V data)  {
    map.put(key, data);
  }
}

public class MapSerializer {
  public static SerializableMap<String, Integer> buildMap() {
    SerializableMap<String, Integer> map = 
        new SerializableMap<String, Integer>();
    map.setData("John Doe", new Integer(123456789));
    map.setData("Richard Roe", new Integer(246813579));
    return map;
  }

  public static void InspectMap(SerializableMap<String, Integer> map) {
    System.out.println("John Doe's number is " + map.getData("John Doe"));
    System.out.println("Richard Roe's number is " +
                       map.getData("Richard Roe")

class SerializableMap<K,V> implements Serializable {
  final static long serialVersionUID = -2648720192864531932L;
  private Map<K,V> map;
  
  public SerializableMap() {
    map = new HashMap<K,V>();
  }

  public static Objectvoid getDatamain(KString[] keyargs)  {
    return// map.get(key);...
  }

  public void setData(K key, V data)  {
    map.put(key, data);
  }
}


public class MapSerializer {

  static public SerializableMap< String, Integer> buildMap() {
    SerializableMap< String, Integer> map = new SerializableMap< String, Integer>();
    map.setData("John Doe", new Integer( 123456789));
    map.setData("Richard Roe", new Integer( 246813579));
    return map;
  }

  static public void InspectMap(SerializableMap< String, Integer> map) {
    System.out.println("John Doe's number is " + map.getData("John Doe"));
    System.out.println("Richard Roe's number is " + map.getData("Richard Roe"));
  }

  public static void main(String[] args) {
    // ...
  }
}

Noncompliant Code Example

This noncompliant code example simply serializes the map and then deserializes it. Thus, the map is capable of being serialized and transferred across different business tiers. Unfortunately, there are no safeguards against byte stream manipulation attacks while the binary data is in transit. Likewise, anyone can reverse engineer the serialized stream data from its hexadecimal notation to reveal the data in the HashMap.

public static void main(String[] args)
  throws IOException, ClassNotFoundException {
  // Build map
  SerializableMap< String, Integer> map = buildMap();

  // Serialize map
  ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject( map);
  out.close();

  // Deserialize map
  ObjectInputStream in = new ObjectInputStream(new FileInputStream("data"));
  map = (SerializableMap< String, Integer>) in.readObject();
  in.close();

  // Inspect map
  InspectMap( map);
}

If the data in the map is considered sensitive, this example will also violate SER03-J. Do not serialize unencrypted, sensitive data.

Noncompliant Code Example (Seal)

To provide message confidentiality, use the javax.crypto.SealedObject class. This class encapsulates a serialized object and encrypts (or seals) it. A strong cryptographic algorithm that uses a secure cryptographic key and padding scheme must be employed to initialize the Cipher object parameter. The seal and unseal utility methods provide the encryption and decryption facilities respectively.

This noncompliant code example encrypts the map into a SealedObject, rendering the data inaccessable to prying eyes. However, since the data is not signed, it provides no proof of authentication.

}

This code sample defines a serializable map, a method to populate the map with values, and a method to check the map for those values.

This noncompliant code example simply serializes then deserializes the map. Consequently, the map can be serialized and transferred across different business tiers. Unfortunately, the example lacks any safeguards against byte stream manipulation attacks while the binary data is in transit. Likewise, anyone can reverse-engineer the serialized stream data to recover the data in the HashMap. Anyone would also be able to tamper with the map and produce an object that made the deserializer crash or hang.

public static void main(String[] args)
                        throws IOException, ClassNotFoundException {
  // Build map
  SerializableMap<String, Integer> map = buildMap();

  // Serialize map
  ObjectOutputStream out =
      new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject(map);
  out.close();

  // Deserialize map
  ObjectInputStream in =
      new ObjectInputStream(new FileInputStream("data"));
  map = (SerializableMap<String, Integer>) in.readObject();
  in.close();

  // Inspect map
  InspectMap(map);
}

If the data in the map were sensitive, this example would also violate SER03-J. Do not serialize unencrypted sensitive data.

Noncompliant Code Example (Seal)

This noncompliant code example uses the javax.crypto.SealedObject class to provide message confidentiality. This class encapsulates a serialized object and encrypts (or seals) it. A strong cryptographic algorithm that uses a secure cryptographic key and padding scheme must be employed to initialize the Cipher object parameter. The seal() and unseal() utility methods provide the encryption and decryption facilities respectively.

This noncompliant code example encrypts the map into a SealedObject, rendering the data inaccessible to prying eyes. However, the program fails to sign the data, rendering it impossible to authenticate.

public static void main(String[] args)
                        throws IOException, GeneralSecurityException, 
                               ClassNotFoundException {
  // Build map
  SerializableMap<String, Integer> map = buildMap();

  // Generate sealing key & seal map
  KeyGenerator generator;
  generator = KeyGenerator.getInstance("AES");
  generator.init(new SecureRandom());
  Key key = generator.generateKey();
  Cipher cipher = Cipher.getInstance("AES");
  cipher.init(Cipher.ENCRYPT_MODE, key);
  SealedObject sealedMap = new SealedObject(map, cipher);

  // Serialize map
  ObjectOutputStream out =
      new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject(sealedMap);
  out.close

public static void main(String[] args)
  throws IOException, GeneralSecurityException, ClassNotFoundException {
  // Build map
  SerializableMap< String, Integer> map = buildMap();

  // GenerateDeserialize sealingmap
 key &ObjectInputStream sealin map=
   KeyGenerator generator;
  generatornew = KeyGenerator.getInstanceObjectInputStream(new FileInputStream("DESdata"));
  sealedMap = generator.init(new SecureRandom()SealedObject) in.readObject();
  Key key = generator.generateKeyin.close();

  // Unseal map
 Cipher cipher = Cipher.getInstance("DESAES");
  cipher.init( Cipher.ENCRYPTDECRYPT_MODE, key);
  SealedObject sealedMapmap = new SealedObject(SerializableMap<String, map, Integer>) sealedMap.getObject(cipher);

  // SerializeInspect map
  ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject( sealedMap);
  out.close();

  // Deserialize map
  ObjectInputStream in = new ObjectInputStream(new FileInputStream("data"));
  sealedMap = (SealedObject) in.readObject();
  in.close();

  // Unseal map
  cipher = Cipher.getInstance("DES");
  cipher.init( Cipher.DECRYPT_MODE, key);
  map = (SerializableMap< String, Integer>) sealedMap.getObject(cipher);

  // Inspect map
  InspectMap( map);
}

Noncompliant Code Example (Seal, Sign)

Use the java.security.SignedObject class to sign an object, when the integrity of the object is to be ensured. The two new arguments passed in to the SignedObject() method to sign the object are Signature and a private key derived from a KeyPair object. To verify the signature, a PublicKey as well as a Signature argument is passed to the SignedObject.verify() method.

InspectMap(map);
}

Noncompliant Code Example (Seal Then Sign)

This noncompliant code example uses the java.security.SignedObject class to sign an object when the integrity of the object must be ensured. The two new arguments passed in to the SignedObject() method to sign the object are Signature and a private key derived from a KeyPair object. To verify the signature, a PublicKey as well as a Signature argument is passed to the SignedObject.verify() method.

This noncompliant code example signs the object as well as seals it. According to Abadi and Needham [Abadi 1996],

When a principal signs material that has already been encrypted, it should not be inferred that the principal knows the content of the message. On the other hand, it is proper to infer that the principal that signs a message and then encrypts it for privacy knows the content of the message.

Any malicious party can intercept the originally signed encrypted message from the originator, strip the signature, and add its own signature to the encrypted message. Both the malicious party and the receiver have no information about the contents of the original message because it is encrypted and then signed (it can be decrypted only after verifying the signature). The receiver has no way of confirming the sender's identity unless the legitimate sender's public key is obtained over a secure channel. One of the three Internal Telegraph and Telephone Consultative Committee (CCITT) X.509 standard protocols was susceptible to such an attack [CCITT 1988].

Because the signing occurs after the sealing, This noncompliant code example signs the object as well as sealing it. Unfortunately, the signing occurs after the sealing. As discussed above, anyone can sign a sealed object, and so it cannot be assumed that the signer is the true originator of the object.

public static void main(String[] args)
    throws IOException, GeneralSecurityException, ClassNotFoundException {
  // Build map
  SerializableMap< String, Integer> map = buildMap();

  // Generate sealing keythrows &IOException, sealGeneralSecurityException, map
  KeyGenerator generator;
  generator = KeyGenerator.getInstance("DES");
  generator.init(new SecureRandom());
  Key key = generator.generateKey();
  Cipher cipher = Cipher.getInstance("DES");
  cipher.init( Cipher.ENCRYPT_MODE, key);
  SealedObject sealedMap = new SealedObject( map, cipher    ClassNotFoundException {
  // Build map
  SerializableMap<String, Integer> map = buildMap();

  // Generate signing public/privatesealing key pair & signseal map
  KeyPairGenerator kpgKeyGenerator generator;
  generator = KeyPairGeneratorKeyGenerator.getInstance("DSAAES");
  KeyPair kp = kpg.generateKeyPairgenerator.init(new SecureRandom());
  Key key = generator.generateKey();
  SignatureCipher sigcipher = SignatureCipher.getInstance("SHA1withDSA"AES");
  cipher.init(Cipher.ENCRYPT_MODE, key);
  SignedObjectSealedObject signedMapsealedMap = new SignedObjectSealedObject( sealedMapmap, kp.getPrivate(), sig)cipher);

  // Serialize Generate signing public/private key pair & sign map
  ObjectOutputStreamKeyPairGenerator outkpg = new ObjectOutputStream(new FileOutputStream("data")KeyPairGenerator.getInstance("DSA");
  KeyPair kp = outkpg.writeObjectgenerateKeyPair( signedMap);
  Signature sig = outSignature.closegetInstance("SHA1withDSA");

  //SignedObject DeserializesignedMap map=
  ObjectInputStream in = new ObjectInputStream(new FileInputStream("data"));
  signedMap = (SignedObject) in.readObject();
  in.close(SignedObject(sealedMap, kp.getPrivate(), sig);

  // UnsignSerialize map
  if (!signedMap.verify(kp.getPublic(), sig)) {
ObjectOutputStream out = 
      thrownew ObjectOutputStream(new GeneralSecurityExceptionFileOutputStream("Map failed verificationdata"));
  }out.writeObject(signedMap);
  sealedMap = (SealedObject) signedMap.getObjectout.close();

  // UnsealDeserialize map
  cipherObjectInputStream in = Cipher.getInstance("DES");
  cipher.init( Cipher.DECRYPT_MODE, key    new ObjectInputStream(new FileInputStream("data"));
  mapsignedMap = (SerializableMap< String, Integer>) sealedMap.getObject(cipherSignedObject) in.readObject();
  in.close();

  // Inspect Verify signature and retrieve map
  if InspectMap( map);
}

Compliant Solution (Sign, Seal)

This compliant solution correctly signs the object before sealing it. This provides a guarantee of authenticity to the object, in addition to protection from man-in-the-middle attacks.

public static void main(String[] args)
  throws IOException, GeneralSecurityException, ClassNotFoundException {
  // Build map
  SerializableMap< String, Integer> map = buildMap(!signedMap.verify(kp.getPublic(), sig)) {
    throw new GeneralSecurityException("Map failed verification");
  }
  sealedMap = (SealedObject) signedMap.getObject();

  // GenerateUnseal map
 signing public/private key pair & sign map
  KeyPairGenerator kpg cipher = KeyPairGeneratorCipher.getInstance("DSAAES");
  KeyPair kp = kpg.generateKeyPair(cipher.init(Cipher.DECRYPT_MODE, key);
  Signature sig = Signature.getInstance("SHA1withDSA");
  SignedObject signedMap = new SignedObject( map, kp.getPrivate(), sig);

map = (SerializableMap<String, Integer>) sealedMap.getObject(cipher);

  // Generate sealing key & sealInspect map
  InspectMap(map);
}

Compliant Solution (Sign Then Seal)

This compliant solution correctly signs the object before sealing it. This approach provides a guarantee of authenticity to the object in addition to protection from man-in-the-middle attacks.

public static void main(String[] args)
                        throws
  IOException, GeneralSecurityException, 
                               ClassNotFoundException {
  // Build map
  SerializableMap<String, Integer> map = buildMap();

  // Generate signing public/private key pair & sign map
  KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");
  KeyPair kp = kpg.generateKeyPair();
  Signature sig = Signature.getInstance("SHA1withDSA");
  SignedObject signedMap = new SignedObject(map, kp.getPrivate(), sigKeyGenerator generator;
  generator = KeyGenerator.getInstance("DES");
  generator.init(new SecureRandom());
  Key key = generator.generateKey();
  Cipher cipher = Cipher.getInstance("DES");
  cipher.init( Cipher.ENCRYPT_MODE, key);
  SealedObject sealedMap = new SealedObject( signedMap, cipher);

  // Serialize map
  ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject( sealedMap);
  out.close();

  // Deserialize map
  ObjectInputStream in = new ObjectInputStream(new FileInputStream("data"));
  sealedMap = (SealedObject) in.readObject();
  in.close();

  // Unseal map
  cipher = Cipher.getInstance("DES");
  cipher.init( Cipher.DECRYPT_MODE, key);
  signedMap = (SignedObject) sealedMap.getObject(cipher);

  // Unsign map
  if (!signedMap.verify(kp.getPublic(), sig)) {
    throw new GeneralSecurityException("Map failed verification");
  }
  map = (SerializableMap<String, Integer>) signedMap.getObject();

  // Inspect map
  InspectMap( map);
}

Exceptions

*SEC16-EX0:* A reasonable use for signing a sealed object is to certify the authenticity of a sealed object passed from elsewhere. In the spirit of the \[[Abadi 1996|AA. Bibliography#Abadi 96]\] quotation above, this represents a commitment _about the sealed object itself_ rather than about its content.

Risk Assessment

Failure to sign and/or seal objects during transit can lead to loss of object integrity or confidentiality.

Automated Detection

Not amenable to static analysis in the general case.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] 
\[[Gong 2003|AA. Bibliography#Gong 03]\] 9.10 Sealing Objects
\[[Harold 1999|AA. Bibliography#Harold 99]\] Chapter 11: Object Serialization, Sealed Objects 
\[[Neward 2004|AA. Bibliography#Neward 04]\] Item 64: Use SignedObject to provide integrity of Serialized objects and Item 65: Use SealedObject to provide confidentiality of Serializable objects
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 319|http://cwe.mitre.org/data/definitions/319.html] "Cleartext Transmission of Sensitive Information"
\[[Steel 2005|AA. Bibliography#Steel 05]\] Chapter 10: Securing the Business Tier, Obfuscated Transfer Object

Generate sealing key & seal map
  KeyGenerator generator;
  generator = KeyGenerator.getInstance("AES");
  generator.init(new SecureRandom());
  Key key = generator.generateKey();
  Cipher cipher = Cipher.getInstance("AES");
  cipher.init(Cipher.ENCRYPT_MODE, key);
  SealedObject sealedMap = new SealedObject(signedMap, cipher);

  // Serialize map
  ObjectOutputStream out = 
      new ObjectOutputStream(new FileOutputStream("data"));
  out.writeObject(sealedMap);
  out.close();

  // Deserialize map
  ObjectInputStream in =
      new ObjectInputStream(new FileInputStream("data"));
  sealedMap = (SealedObject) in.readObject();
  in.close();

  // Unseal map
  cipher = Cipher.getInstance("AES");
  cipher.init(Cipher.DECRYPT_MODE, key);
  signedMap = (SignedObject) sealedMap.getObject(cipher);

  // Verify signature and retrieve map
  if (!signedMap.verify(kp.getPublic(), sig)) {
    throw new GeneralSecurityException("Map failed verification");
  }
  map = (SerializableMap<String, Integer>) signedMap.getObject();

  // Inspect map
  InspectMap(map);
}

Exceptions

SER02-J-EX0: A reasonable use for signing a sealed object is to certify the authenticity of a sealed object passed from elsewhere. This use represents a commitment about the sealed object itself rather than about its content [Abadi 1996].

SER02-J-EX1: Signing and sealing is required only for objects that must cross a trust boundary. Objects that never leave the trust boundary need not be signed or sealed. For example, when an entire network is contained within a trust boundary, objects that never leave that network need not be signed or sealed. Another example is objects that are only sent down a signed binary stream.

Risk Assessment

Failure to sign and then seal objects during transit can lead to loss of object integrity or confidentiality.

Automated Detection

This rule is not amenable to static analysis in the general case.

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedSEC15-J. Use SSLSockets rather than Sockets for secure data exchange      14. Platform Security (SEC)      SEC17-J. Create and sign a SignedObject before creating a SealedObject