Description

Detects use of predictable initialization vectors (IVs) or nonces in Ruby OpenSSL cryptographic operations. Using predictable values like timestamps or sequential numbers for IVs compromises encryption security, allowing attackers to potentially decrypt data or perform cryptographic attacks.

Detection Strategy

• Only analyzes Ruby code that imports the 'openssl' library

• Identifies variable assignments where the variable name contains 'iv' (initialization vector)

• Checks if the assigned value is a predictable time-based value (like timestamps, current time, or sequential numbers)

• Verifies that the IV assignment is used in conjunction with OpenSSL cipher construction and encryption operations

• Reports a vulnerability when a predictable value is assigned to an IV variable that is then used in cryptographic encryption

Vulnerable code example

require 'openssl'

def encrypt_with_predictable_iv(data)
  cipher = OpenSSL::Cipher.new('aes-256-cbc')
  cipher.encrypt
  cipher.key = OpenSSL::Random.random_bytes(32)
  
  # VULNERABLE: IV derived from timestamp is predictable...

✅ Secure code example

require 'openssl'
require 'securerandom'

def encrypt_with_predictable_iv(data)
  cipher = OpenSSL::Cipher.new('aes-256-cbc')
  cipher.encrypt
  cipher.key = OpenSSL::Random.random_bytes(32)
  ...