Metadata

ID: java-security/random-iv

Language: Java

Severity: Warning

Category: Security

CWE: 1204

Description

The initialization vector (IV) for a cryptographic operation must be random and not statically declared. Instead of using a static initialization vector, use the SecureRandom class that will initialize your vector with real random values.

Learn More

• SecureRandom documentation
• CWE-1204: Generation of Weak Initialization Vector (IV)

Non-Compliant Code Examples

public class Foo {
    void bad() {
        byte[] iv = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, };
    }

    void alsoBad() {
        byte[] iv = "secret iv in here".getBytes();
    }
}

Compliant Code Examples

public class Foo {
    void good() {
        SecureRandom random = new SecureRandom();
        byte iv[] = new byte[16];
        random.nextBytes(bytes);
    }
}