Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
This rule addresses the use of Initialization Vectors (IVs) in counter mode encryption. An Initialization Vector is a random number that is used as the starting point for encryption algorithms. It’s essential to generate fresh IVs for every encryption operation to ensure the output is not predictable, enhancing the overall security of the encryption process.
Using static or hard-coded IVs introduces a significant security risk. If an attacker knows the IV, they can predict the output of the encryption, making it much easier to break. The fundamental principle of cryptography is to keep all aspects of the encryption process as unpredictable as possible.
To adhere to this rule, always generate a fresh, random IV for each encryption operation. This ensures that even if an attacker manages to compromise one encryption operation, subsequent operations remain secure due to the unpredictability of the IVs.
Non-Compliant Code Examples
// Noncompliant - Using a static IV
classInsecureEncryption{funencryptData(secretKey:String,data:ByteArray):ByteArray{// BAD: Hardcoded IV that will be reused for every encryption
valstaticIV="staticIVvalue123".toByteArray()valcipher=Cipher.getInstance("AES/CCM/NoPadding")valkey=SecretKeySpec(secretKey.toByteArray(),"AES")valparamSpec=CCMParameterSpec(128,staticIV)cipher.init(Cipher.ENCRYPT_MODE,key,paramSpec)returncipher.doFinal(data)}}
Compliant Code Examples
// Compliant - Using a secure random IV
classSecureEncryption{funencryptData(secretKey:String,data:ByteArray):ByteArray{// GOOD: Generate fresh random IV for each encryption
valsecureRandom=SecureRandom()valrandomIV=ByteArray(12).apply{secureRandom.nextBytes(this)}valcipher=Cipher.getInstance("AES/CCM/NoPadding")valkey=SecretKeySpec(secretKey.toByteArray(),"AES")valparamSpec=CCMParameterSpec(128,randomIV)cipher.init(Cipher.ENCRYPT_MODE,key,paramSpec)returncipher.doFinal(data)}}
Seamless integrations. Try Datadog Code Security
Datadog Code Security
Try this rule and analyze your code with Datadog Code Security
How to use this rule
1
2
rulesets:- kotlin-security # Rules to enforce Kotlin security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Security scans to your CI pipelines