Description

This detector identifies hardcoded initialization vectors (IVs) in Ruby code when using AEAD (Authenticated Encryption with Associated Data) ciphers from the OpenSSL library. Hardcoded IVs compromise cryptographic security by making encrypted data predictable and vulnerable to various attacks including known-plaintext and chosen-plaintext attacks.

Detection Strategy

• The OpenSSL library must be imported in the Ruby code

• Code must contain an assignment to an 'iv' attribute

• The assignment must be within an AEAD cipher construction context

• The assigned value must be a hardcoded (non-empty) literal value rather than a dynamically generated one

Vulnerable code example

require 'openssl'

def encrypt_data(data)
  cipher = OpenSSL::Cipher.new('aes-256-gcm')
  cipher.encrypt
  cipher.key = OpenSSL::Random.random_bytes(32)
  
  # VULNERABLE: hardcoded IV reuses same nonce, breaking GCM security...

✅ Secure code example

require 'openssl'

def encrypt_data(data)
  cipher = OpenSSL::Cipher.new('aes-256-gcm')
  cipher.encrypt
  cipher.key = OpenSSL::Random.random_bytes(32)
  
  # SECURE: Generate random IV to ensure unique nonce for GCM mode...