title: SonarQube: Make sure that encrypting data is safe here. AES/GCM/NoPadding, RSA/ECB/PKCS1Padding
body: <p>I'm using:</p>
  
  <p><strong>1. RSA/ECB/PKCS1Padding</strong></p>
  
  <p><strong>2. AES/GCM/NoPadding</strong></p>
  
  <p>To encrypt my data in my Android (Java) application. At the <a href="https://rules.sonarsource.com/java/RSPEC-4787" rel="nofollow noreferrer">documentation</a> of SonarQube it states that:</p>
  
  <p><em>The Advanced Encryption Standard (AES) encryption algorithm can be used with various modes. Galois/Counter Mode (GCM) with no padding should be preferred to the following combinations which are not secured:</em></p>
  
  <ul>
  <li><em>Electronic Codebook (ECB) mode: Under a given key, any given
  plaintext block always gets encrypted to the same ciphertext block.
  Thus, it does not hide data patterns well. In some senses, it doesn't
  provide serious message confidentiality, and it is not recommended
  for use in cryptographic protocols at all.</em> </li>
  <li><em>Cipher Block Chaining    (CBC) with PKCS#5 padding (or PKCS#7) is
  susceptible to padding    oracle attacks.</em></li>
  </ul>
  
  <p>So, as it is <strong>recommended</strong>, I use <code>AES/GCM/NoPadding</code> as :</p>
  
  <pre><code>Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
  </code></pre>
  
  <p>But, it still gives me the warning <strong>Make sure that encrypting data is safe here.</strong></p>
  
  <p>The same for: </p>
  
  <pre><code>Cipher c = Cipher.getInstance("RSA/ECB/PKCS1Padding");
  </code></pre>
  
  <p>Why does <strong>SonarQube</strong> throws that warning?
  Aren't these uses safe any more?</p>