Search code examples
securityhashcobol

Bad hash function in Cobol


I work on my code analyser and try write some patterns for Cobol vulnerabilities. I spent too much time for searching some functions in Cobol which use in cryptography.

Maybe anybody now about hashing in Cobol? I don't know this language, but learning this question at this moment.


Solution

  • IBM has a program that you can call from a COBOL program and it will return the hashed values. It can handle the following hashes:

    • MD5
    • SHA-1
    • RIPEMD-160
    • SHA-224
    • SHA-256
    • SHA-384
    • SHA-512

    This will only work on IBM COBOL. The link I provided shows an example of the call and describes all of the data required by the linkage section of CSNBOWH (CSNEOWH if you are using AMODE(64))