Description

This detector identifies hardcoded AEAD (Authenticated Encryption with Associated Data) nonces in PHP code. Using hardcoded nonces in AEAD encryption is a critical security vulnerability as nonces must be unique for each encryption operation to maintain cryptographic security. Reusing nonces can lead to complete compromise of the encryption scheme.

Detection Strategy

• The detector first checks if any AEAD-related cryptographic libraries are imported in the PHP file

• It then examines function calls to AEAD encryption methods to identify cases where nonces are hardcoded as literal values rather than dynamically generated

• A vulnerability is reported when AEAD encryption functions are called with static, hardcoded nonce parameters instead of randomly generated or properly incremented values

Vulnerable code example

<?php
use phpseclib3\Crypt\AES;

function encryptData($plaintext) {
    $cipher = new AES('gcm');
    $cipher->setKey(random_bytes(32));
    
    // VULNERABLE: hardcoded nonce reused across calls...

✅ Secure code example

<?php
use phpseclib3\Crypt\AES;

function encryptData($plaintext) {
    $cipher = new AES('gcm');
    $cipher->setKey(random_bytes(32));
    
    // SAFE: generate fresh random nonce for each encryption...