Hardcoded / static Initialization Vector for a symmetric cipher
ID |
vbnet.cryptography.weak_encryption_initialization_vector |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
VB.NET |
Description
A hardcoded or static Initialization Vector (IV) is used for a symmetric cipher. A fixed IV defeats semantic security: identical plaintexts encrypt to identical ciphertexts and it enables chosen-plaintext attacks. Generate a fresh, random IV per operation with GenerateIV() or a CSPRNG (RandomNumberGenerator.GetBytes), and store/transmit it alongside the ciphertext.
Rationale
A hardcoded or static Initialization Vector (IV) is used for a symmetric cipher. A fixed IV defeats semantic security: identical plaintexts encrypt to identical ciphertexts and it enables chosen-plaintext attacks. Generate a fresh, random IV per operation with GenerateIV() or a CSPRNG (RandomNumberGenerator.GetBytes), and store/transmit it alongside the ciphertext.
The following code illustrates a vulnerable pattern detected by this rule:
Sub HardcodedIvProperty()
Dim aes As Aes = Aes.Create()
aes.Key = GetKey()
' VULNERABLE: Hardcoded / static Initialization Vector for a symmetric cipher
aes.IV = New Byte() {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.