Summary

The system should use initialization vectors, nonces and other single use numbers only once with a given encryption key.

Description

The system's cryptographic keys are essential for maintaining the confidentiality and integrity of transactions and communications. Some encryption mechanisms use initialization vectors to reduce the chances that a message will be decrypted. These vectors should be generated using cryptographically secure random number generators and should only be used once with a given encryption key.

References

• CWE-326. Inadequate encryption strength
• CERTJ-TSM02-J. Do not use background threads during class initialization
• CMMC-AC_L1-3_1_2. Transaction & function control
• CMMC-SC_L1-3_13_1. Boundary protection
• HITRUST-09_y. On-line transactions
• HITRUST-10_g. Key management
• ISO27002-8_24. Use of cryptography
• ASVS-6_2_3. Algorithms
• ASVS-6_2_6. Algorithms
• ISO27001-8_24. Use of cryptography
• CASA-6_2_3. Algorithms
• CASA-6_2_6. Algorithms