Insecure generation of random numbers - Static IV
Description
The application uses static, hardcoded values for initialization vectors. By knowing initialization vectors an attacker could perform a reverse engineering attack to predict the random values that should remain as secrets.
Impact
Predict random values to craft new attack vectors.
Recommendation
Generate initialization vectors randomly using mechanisms with secure randomness and high entropy.
Threat
Authenticated attacker from the Internet with access to the source code.
Expected Remediation Time
⏱️ 30 minutes.
Requirements
223 - Uniform distribution in random numbers224 - Use secure cryptographic mechanisms346 - Use initialization vectors once371 - Use GCM Padding with AES