Description

This detector identifies the use of predictable initialization vectors (IVs) or nonces in Java cryptographic operations. Predictable IVs compromise encryption security by making encrypted data vulnerable to pattern analysis and cryptographic attacks, particularly in cipher block chaining (CBC) mode where identical plaintext blocks would produce identical ciphertext blocks.

Detection Strategy

• Scans Java code that imports cryptographic libraries from the javax.crypto.spec package

• Identifies constructor calls (init methods) for cryptographic operations that use encryption modes

• Checks if the constructor accepts an encryption mode argument and validates it represents an encryption operation

• Examines the IV/nonce specification argument to determine if it uses predictable values like hardcoded strings, sequential numbers, or other deterministic sources

• Reports a vulnerability when a cryptographic constructor combines encryption mode with predictably generated initialization vectors or nonces

Vulnerable code example

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.spec.GCMParameterSpec;

public class PredictableIvExample {
    
    public static byte[] encryptWithTimestamp(String data, SecretKeySpec key) throws Exception {...

✅ Secure code example

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;

public class SecureIvExample {
    
    public static byte[] encryptWithRandomIv(String data, SecretKeySpec key) throws Exception {...