Description

This detector identifies hardcoded GCM (Galois/Counter Mode) nonce values in Scala cryptographic operations. Using hardcoded nonces in GCM mode severely compromises encryption security, as nonce reuse can lead to complete cryptographic key recovery and plaintext exposure.

Detection Strategy

• Scans Scala source code that imports javax.crypto library for cryptographic operations

• Identifies initialization calls (init expressions) for Cipher objects that use getInstance methods

• Checks if the third argument to the initialization contains hardcoded GCM specification parameters

• Reports vulnerabilities when Cipher.getInstance calls are initialized with static/hardcoded GCM nonce values instead of randomly generated ones

Vulnerable code example

import android.util.Base64
import javax.crypto.Cipher
import javax.crypto.spec.GCMParameterSpec
import javax.crypto.spec.SecretKeySpec

object GcmExample {
  private def getKey(password: String): SecretKeySpec =
    new SecretKeySpec(password.getBytes, "AES")...

✅ Secure code example

import android.util.Base64
import java.security.SecureRandom
import javax.crypto.Cipher
import javax.crypto.spec.GCMParameterSpec
import javax.crypto.spec.SecretKeySpec

object GcmExample {
  private def getKey(password: String): SecretKeySpec =...