Skip to content

MASTG-TEST-0312: References to Explicit Security Provider in Cryptographic APIs

Overview

Android cryptography APIs based on the Java Cryptography Architecture (JCA) allow developers to specify a security provider when calling getInstance methods. However, explicitly specifying a provider can cause security issues and break compatibility because several providers have been deprecated or removed in recent versions. For example:

This test identifies cases where an app explicitly specifies a security provider when using JCA APIs that is not the default provider, AndroidOpenSSL (Conscrypt), which is actively maintained and should generally be used (see Security Provider). It examines getInstance calls and flags any use of a named provider other than legitimate exceptions such as KeyStore.getInstance("AndroidKeyStore").

Steps

  1. Run Static Analysis on Android with a tool such as semgrep on the app binary to look for calls to getInstance that explicitly specify a security provider.

Observation

The output should contain a list of locations where a security provider is explicitly specified in getInstance calls.

Evaluation

The test case fails if any getInstance call explicitly specifies a security provider other than AndroidKeyStore for KeyStore operations. Review each occurrence to determine whether the provider is actually required and whether its use could introduce security or compatibility issues on modern Android versions.

Mitigations

Demos

MASTG-DEMO-0075: Uses of Explicit Security Providers in Cryptographic APIs with semgrep