Description

This vulnerability detector identifies hardcoded AEAD (Authenticated Encryption with Associated Data) nonces in TypeScript code. Using hardcoded nonces in cryptographic operations is a critical security flaw because nonces must be unique for each encryption operation to ensure security. Reusing nonces can allow attackers to recover plaintext or forge authenticated messages.

Detection Strategy

• Scans TypeScript source code files for cryptographic operations that use AEAD encryption algorithms

• Identifies function calls or method invocations related to AEAD encryption (such as AES-GCM, ChaCha20-Poly1305, or similar authenticated encryption schemes)

• Analyzes the nonce/initialization vector parameters passed to these cryptographic functions

• Reports a vulnerability when a nonce parameter is set to a hardcoded static value (string literal, number literal, or hardcoded byte array) instead of being generated dynamically

• Triggers when the same nonce value would be reused across multiple encryption operations, compromising the security guarantees of the AEAD scheme

Vulnerable code example

import * as crypto from 'crypto';

function encryptData(key: Buffer, data: Buffer): Buffer {
  // VULNERABLE: hardcoded nonce creates identical encryption output
  const cipher = crypto.createCipheriv('aes-256-gcm', key, '000000000000');
  return Buffer.concat([cipher.update(data), cipher.final()]);
}

✅ Secure code example

import * as crypto from 'crypto';

function encryptData(key: Buffer, data: Buffer): Buffer {
  const nonce = crypto.randomBytes(12); // SAFE: Random nonce prevents identical outputs
  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
  return Buffer.concat([nonce, cipher.update(data), cipher.final(), cipher.getAuthTag()]);
}