Description

This detector identifies the use of predictable initialization vectors (IVs) or nonces in cryptographic operations. When time-based functions are used to generate IVs/nonces, attackers can predict these values, compromising the security of encryption schemes like AES-GCM or ChaCha20-Poly1305 that rely on unique, unpredictable nonces.

Detection Strategy

• The code must import both AEAD (Authenticated Encryption with Associated Data) cryptographic libraries AND the time library

• A function call to either 'Seal' method on an AEAD cipher object OR a function with a name containing IV-related keywords (like 'NewCBCEncrypter', 'NewCFBEncrypter', etc.) must be present

• The nonce/IV argument passed to these cryptographic functions must be derived from time-based sources (like time.Now(), Unix timestamps, or other time functions) without proper randomization

• The time-based value must flow directly to the cryptographic function without being processed through a secure random number generator or cryptographic hash function

Vulnerable code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"strconv"
	"time"
)...

✅ Secure code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"io"
)...