Insecure generation of random numbers - Static IV
Description
The application uses static, hardcoded values for initialization vectors. By knowing initialization vectors an attacker could perform a reverse engineering attack to predict the random values that should remain as secrets.
Impact
Predict random values to craft new attack vectors.
Recommendation
Generate initialization vectors randomly using mechanisms with secure randomness and high entropy.
Threat
Authenticated attacker from the Internet with access to the source code.
Expected Remediation Time
⏱️ 30 minutes.
Requirements
223 - Uniform distribution in random numbers224 - Use secure cryptographic mechanisms346 - Use initialization vectors once371 - Use GCM Padding with AESRules
Php Hardcoded Cryptographic IvScala Hardcoded Initialization VectorJava Hardcoded Base64 IvSwift Missing Initialization VectorDart Cryptography Hardcoded NoncePhp Missing Initialization VectorPhp Hardcoded Init VectorC Sharp Hardcoded Init VectorDart Hardcoded Crypto IvJava Hardcoded Static IvC Sharp Static Iv In Aes