Add checks for weak public-key cryptography

[bdewater]

Is your feature request related to a problem? Please describe.
Similar to check_weak_hash.rb and inspired by ruby/openssl#546 - it is quite easy to use RSA and other asymmetric algorithms insecurely. Some ideas that can be checked for:

• Small key sizes (eg RSA < 2048 bits = CWE-326) when generating keys
• Insecure padding modes (eg RSA PKCS#1 v1.5 = CWE-780) when doing operations

Describe the solution you'd like
Flag the code like this blog post which specifically showcases CWE-780:

def encrypt(payload)
  public_key = OpenSSL::PKey::RSA.new("grab the public 4096 bit key")
  Base64.encode64(public_key.public_encrypt(payload.to_json)
end

OpenSSL::PKey::RSA#public_encrypt defaults to insecure PKCS#1 v1.5 padding. On modern OpenSSL gems (>= 3.0) this is a wrapper for OpenSSL::PKey::PKey#encrypt, so effectively the following code is called:

public_key.encrypt(payload.to_json, "rsa_padding_mode" => "pkcs1")

Both types of calls should be flagged.

Describe alternatives you've considered
N/A

[presidentbeef]

Nice suggestion!

[iamjohnford]

The current checks don't appear to catch the following version of the weak RSA padding mode:

public_key.encrypt(payload.to_json, rsa_padding_mode: "pkcs1")

Should a check for that be added as well?