Insecure generation of random numbers - Static IV
Description
The application uses static, hardcoded values for initialization vectors. By knowing initialization vectors an attacker could perform a reverse engineering attack to predict the random values that should remain as secrets.
Impact
Predict random values to craft new attack vectors.
Recommendation
Generate initialization vectors randomly using mechanisms with secure randomness and high entropy.
Threat
Authenticated attacker from the Internet with access to the source code.
Expected Remediation Time
⏱️ 30 minutes.
Requirements
223 - Uniform distribution in random numbers224 - Use secure cryptographic mechanisms346 - Use initialization vectors once371 - Use GCM Padding with AESRules
Php Hardcoded Aead NoncePhp Hardcoded Cryptographic IvScala Hardcoded Gcm NoncePython Hardcoded Aead NonceTypescript Hardcoded Aead NonceScala Predictable Iv Nonce SourcePhp Predictable Iv Nonce SourceGo Predictable Iv Nonce SourceC Sharp Hardcoded Aead NonceRuby Hardcoded Aead NonceGo Key Derived Iv NonceJavascript Hardcoded Aead NonceScala Hardcoded Initialization VectorGo Hardcoded Aead NoncePhp Key Derived Iv NonceJava Hardcoded Base64 IvSwift Missing Initialization VectorJavascript Predictable Iv Nonce SourceDart Cryptography Hardcoded NonceKotlin Key Derived Iv NoncePhp Missing Initialization VectorJava Key Derived Iv NonceKotlin Predictable Iv Nonce SourcePython Key Derived Iv NonceSwift Predictable Iv Nonce SourceJavascript Key Derived Iv NonceJava Hardcoded Gcm NonceScala Key Derived Iv NonceRust Hardcoded Aead NonceElixir Hardcoded Aead NonceSwift Hardcoded Aead NonceC Sharp Key Derived Iv NonceTypescript Predictable Iv Nonce SourcePhp Hardcoded Init VectorC Sharp Predictable Iv Nonce SourceRust Predictable Iv Nonce SourceC Sharp Hardcoded Init VectorTypescript Key Derived Iv NonceRuby Predictable Iv Nonce SourceDart Hardcoded Crypto IvJava Hardcoded Static IvC Sharp Static Iv In AesElixir Predictable Iv Nonce SourceElixir Key Derived Iv NonceJava Predictable Iv Nonce SourcePython Predictable Iv Nonce SourceDart Predictable Iv Nonce SourceRust Key Derived Iv Nonce