Description

Detects hardcoded cryptographic nonces in Go's AEAD (Authenticated Encryption with Associated Data) seal operations. Using hardcoded nonces breaks the cryptographic security guarantees as nonces must be unique for each encryption operation. This vulnerability allows attackers to potentially recover plaintext or forge authenticated ciphertext.

Detection Strategy

• Scans Go source code files that import cryptographic libraries containing AEAD functionality (such as crypto/cipher, crypto/aes, etc.)

• Identifies function calls to AEAD seal methods that perform encryption operations

• Examines the nonce parameter (typically the second argument) passed to these seal operations

• Reports a vulnerability when the nonce argument is traced back to a hardcoded byte array, string literal, or other static value definition

• Only triggers when the nonce value can be determined at compile-time rather than being dynamically generated at runtime

Vulnerable code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
)

func encryptData(key, plaintext []byte) ([]byte, error) {...

✅ Secure code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"io"
)...