Description

This detector identifies the use of predictable Initialization Vectors (IV) or nonces in Dart cryptographic operations. Using predictable IVs/nonces compromises encryption security by making encrypted data vulnerable to cryptanalytic attacks, allowing attackers to potentially decrypt or manipulate encrypted information.

Detection Strategy

• When Dart code imports cryptography packages and calls encryption methods with a 'nonce' parameter that comes from a predictable source (like hardcoded values, timestamps, or sequential numbers)

• When Dart code uses IV/nonce creation methods from encryption libraries with arguments that are sourced from predictable values rather than cryptographically secure random generators

• The vulnerability is triggered when the data flow analysis determines that the IV or nonce value originates from an unsafe, predictable source that could be guessed or reproduced by an attacker

Vulnerable code example

import 'dart:convert';
import 'package:encrypt/encrypt.dart';
import 'package:cryptography/cryptography.dart';

void encryptWithPredictableIV() {
  // VULNERABLE: IV derived from DateTime.now() is predictable
  final iv = IV.fromUtf8(DateTime.now().millisecondsSinceEpoch.toString().padLeft(16, '0'));
  ...

✅ Secure code example

import 'dart:convert';
import 'package:encrypt/encrypt.dart';
import 'package:cryptography/cryptography.dart';

void encryptWithPredictableIV() {
  // SECURE: Generate cryptographically random IV
  final iv = IV.fromSecureRandom(16);
  ...