Description

This detector identifies Swift code using cryptographic algorithms that require an initialization vector (IV) but fail to provide one. Missing initialization vectors in encryption operations can lead to predictable or weak encryption patterns, compromising data security and potentially enabling cryptographic attacks.

Detection Strategy

• Import check: The code must import the CommonCrypto library

• Function call identification: The detector searches for calls to cryptographic functions that require initialization vectors

• IV validation: For each identified cryptographic function call, the detector checks if an initialization vector parameter is properly provided

• Vulnerability reporting: If a function requiring an IV is called without providing one, a security vulnerability is reported

Vulnerable code example

import CommonCrypto

func encryptData(data: [UInt8], key: [UInt8]) -> [UInt8] {
    var outLength = 0
    var outBytes = [UInt8](repeating: 0, count: data.count + kCCBlockSizeAES128)
    CCCrypt(
        CCOperation(kCCEncrypt),
        CCAlgorithm(kCCAlgorithmAES),...

✅ Secure code example

import CommonCrypto

func encryptData(data: [UInt8], key: [UInt8]) -> [UInt8] {
    var outLength = 0
    var outBytes = [UInt8](repeating: 0, count: data.count + kCCBlockSizeAES128)
    
    // Generate secure random IV
    var iv = [UInt8](repeating: 0, count: kCCBlockSizeAES128)...