Description

This detector identifies hardcoded nonces used in Swift's CryptoKit AEAD (Authenticated Encryption with Associated Data) encryption operations. Using hardcoded nonces in AEAD encryption is a critical security flaw as nonces must be unique per encryption operation to maintain cryptographic security.

Detection Strategy

• Scans Swift source code that imports the CryptoKit library

• Identifies calls to AEAD encryption functions (seal operations) from CryptoKit

• Checks if the nonce parameter in these encryption calls uses a hardcoded value instead of a randomly generated one

• Reports a vulnerability when AEAD seal operations are found with static/hardcoded nonce values

Vulnerable code example

import CryptoKit

func encryptData(message: Data, key: SymmetricKey) throws -> AES.GCM.SealedBox {
    let nonce = try! AES.GCM.Nonce(data: Data("000000000000".utf8))
    
    // VULNERABLE: hardcoded nonce creates identical values on every call
    return try AES.GCM.seal(message, using: key, nonce: nonce)
}

✅ Secure code example

import CryptoKit

func encryptData(message: Data, key: SymmetricKey) throws -> AES.GCM.SealedBox {
    // SAFE: omit nonce parameter - CryptoKit generates a secure random nonce
    return try AES.GCM.seal(message, using: key)
}