Uploaded image for project: 'Rules Repository'
  1. Rules Repository
  2. RSPEC-3329

Cypher Block Chaining IV's should be random and unique

    Details

    • Type: Vulnerability Detection
    • Status: Active
    • Resolution: Unresolved
    • Labels:
    • Message:
      * Use a dynamically-generated, random IV.
    • Default Severity:
      Critical
    • Impact:
      High
    • Likelihood:
      Low
    • Targeted languages:
      C#, C++, Objective-C, PHP, Python, Swift, VB.Net
    • Covered Languages:
      Java
    • Remediation Function:
      Constant/Issue
    • Constant Cost:
      15min
    • Analysis Level:
      Control-flow Analysis
    • Analysis Scope:
      Main Sources
    • Implementation details:
    • Common Rule:
      Yes
    • CWE:
      CWE-330
    • OWASP:
      A6
    • FindSecBugs:
      STATIC_IV

      Description

      In encryption, when Cipher Block Chaining (CBC) is used, the Initialization Vector (IV) must be random and unpredictable. Otherwise, the encrypted value is vulnerable to crypto-analysis attacks such as the "Chosen-Plaintext Attack".

      An IV value should be associated to one, and only one encryption cycle, because the IV's purpose is to ensure that the same plaintext encrypted twice will yield two different ciphertexts.

      To that end, IV's should be:

      • random
      • unpredictable
      • publishable (IV's frequently are published)
      • authenticated, along with the ciphertext, with a Message Authentication Code (MAC)

      This rule raises an issue when the IV is:

      • hard-coded
      • created using java.util.Random rather than java.security.SecureRandom.

      Noncompliant Code Example

      public class MyCbcClass {
      
        public String applyCBC(String strKey, String plainText) {
          byte[] bytesIV = "7cVgr5cbdCZVw5WY".getBytes("UTF-8");
      
          /* KEY + IV setting */
          IvParameterSpec iv = new IvParameterSpec(bytesIV);
          SecretKeySpec skeySpec = new SecretKeySpec(strKey.getBytes("UTF-8"), "AES");
      
          /* Ciphering */
          Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
          cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);  // Noncompliant because IV hard coded and cannot vary with each ciphering round
          byte[] encryptedBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
          return DatatypeConverter.printBase64Binary(bytesIV) // IV is typically published
                  + ";" + DatatypeConverter.printBase64Binary(encryptedBytes);
        }
      }
      

      Compliant Solution

      public class MyCbcClass {
      
        SecureRandom random = new SecureRandom();
      
        public String applyCBC(String strKey, String plainText) {
          byte[] bytesIV = new byte[16];
          random.nextBytes(bytesIV);
      
          /* KEY + IV setting */
          IvParameterSpec iv = new IvParameterSpec(bytesIV);
          SecretKeySpec skeySpec = new SecretKeySpec(strKey.getBytes("UTF-8"), "AES");
      
          /* Ciphering */
          Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
          cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
          byte[] encryptedBytes = cipher.doFinal(plainText.getBytes("UTF-8"));
          return DatatypeConverter.printBase64Binary(bytesIV)
                  + ";" + DatatypeConverter.printBase64Binary(encryptedBytes);
        }
      }
      

      See

      • MITRE, CWE-330 - Use of Insufficiently Random Values
      • OWASP Top 10 2017 Category A6 - Security Misconfiguration
      • Derived from FindSecBugs rule STATIC_IV

        Issue Links

          Activity

          There are no comments yet on this issue.

            People

            • Assignee:
              Unassigned
              Reporter:
              ann.campbell.2 Ann Campbell
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated: