Description

Detects hardcoded nonces (number used once) in AEAD (Authenticated Encryption with Associated Data) cryptographic operations in C# code. Hardcoded nonces compromise the security guarantees of AEAD ciphers by making encrypted data predictable and vulnerable to cryptographic attacks.

Detection Strategy

• Scans C# source code for method calls or function invocations related to AEAD encryption operations

• Identifies when nonce parameters in AEAD functions are set to hardcoded literal values (strings, byte arrays, or numeric constants)

• Reports vulnerabilities when cryptographic nonces are not dynamically generated or properly randomized

• Triggers on AEAD cipher implementations where the nonce value can be determined at compile time rather than runtime

Vulnerable code example

using System;
using System.Security.Cryptography;

public class VulnerableGcmNonce
{
    public void EncryptWithHardcodedNonce()
    {
        byte[] key = new byte[32];...

✅ Secure code example

using System;
using System.Security.Cryptography;

public class SecureGcmNonce
{
    public void EncryptWithRandomNonce()
    {
        byte[] key = new byte[32];...