Request for Updated Encryption and Hashing Algorithms

[RajagopiSurineni]

Hello Sir,

We are raising this ticket based on observations from our Security Team regarding the usage of MD5 and CBC algorithms in the current implementation.

During our verification, we identified references using the following command:
grep -r "MD5|md5|PBEWith|AES-CBC" build/

We also noticed that MD5 is being used for user identity hashing in version 4.0.0 and below.

As MD5 and CBC are considered outdated from a security perspective, could you please review the possibility of upgrading to more secure algorithms such as SHA-256 and stronger encryption standards? This enhancement would help us address and close the reported security findings from the VAPT assessment.

Please let us know if any additional information is required from our side.

Thank you for your support.

[darshanclevertap]

@RajagopiSurineni The MD5 algorithm is still in use because it was shipped in one of our older versions. To maintain backward compatibility in the case of an app updating from an old SDK version to a new SDK version, we need to maintain the old code flow.

However, we will note this; we do have plans to get rid of the older/less secure hashing algorithms from all our code bases. I am tagging this as an enhancement request for Q3 and will keep this open till we come back to you with some definite timelines.