Use of a weak cryptographic initialization vector

ID

csharp.weak_encryption_initialization_vector

Severity

critical

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Resource

Cryptography

Language

CSharp

Tags

ASVS50:v11.3.1, CCN-PITFALL/SymEncryption.1, CWE:1204, NIST.SP.800-53, OWASP:2025:A04, PCI-DSS:6.5.3, crypto

Description

The improper use of initialization vectors (IVs) in encryption can weaken data security by enabling pattern detection and making the ciphertext vulnerable to attacks. It’s critical to ensure the IV is generated securely and used correctly to maintain encryption strength.

Rationale

Initialization vectors (IVs) are crucial in encryption schemes like CBC or GCM to ensure the same plaintext results in different ciphertexts. A weak or improperly used IV, such as a static or predictable one, can allow attackers to uncover patterns in the data, leading to potential data leaks or unauthorized access.

The rule reports a fixed IV given to a cipher, such as new byte[16] or Encoding.UTF8.GetBytes("0123456789abcdef"), inline or held in a field.

Consider the following C# code, which encrypts every message with the same IV:

using System.Security.Cryptography;
using System.Text;

public class TokenProtector
{
    private readonly byte[] _key;

    public TokenProtector(byte[] key)
    {
        _key = key;
    }

    public byte[] Protect(byte[] data)
    {
        using var aes = Aes.Create();
        aes.Key = _key;
        aes.IV = Encoding.UTF8.GetBytes("0123456789abcdef"); // FLAW
        using var encryptor = aes.CreateEncryptor();
        return encryptor.TransformFinalBlock(data, 0, data.Length);
    }
}

Two messages that start with the same block produce ciphertexts that start with the same block, so an observer learns which messages share a prefix.

Remediation

To remediate issues with weak or improperly used IVs, ensure they are generated securely and uniquely for each encryption operation.

Let the algorithm generate a random IV (Aes.Create() already does, and GenerateIV() makes a new one), or fill one with RandomNumberGenerator, and store it next to the ciphertext: the IV does not need to be secret.

using System;
using System.Security.Cryptography;

public class TokenProtector
{
    private readonly byte[] _key;

    public TokenProtector(byte[] key)
    {
        _key = key;
    }

    public byte[] Protect(byte[] data)
    {
        var iv = RandomNumberGenerator.GetBytes(16);
        using var aes = Aes.Create();
        aes.Key = _key;
        var cipher = aes.EncryptCbc(data, iv);

        var result = new byte[iv.Length + cipher.Length];
        Buffer.BlockCopy(iv, 0, result, 0, iv.Length);
        Buffer.BlockCopy(cipher, 0, result, iv.Length, cipher.Length);
        return result;
    }
}

References

© 2026 Xygeni. All rights reserved