chethan (Community Member) asked a question.

May 27, 2021 at 8:57 PM
Resolving CWE-327 Use of a Broken or Risky Cryptographic Algorithm

I'm trying to use AES Algorithm to mitigate the CWE-327 vulnerability. Initialization Vector(IV) needs to be provided as part of this and this value needs to be randomized.

 

Issue: Randomizing the IV value is resulting in an incorrect decoded value because of different IV values used at the time of encryption and decryption.

 

Our process invokes the encrypt and decrypt operations separately, which means generating a different IV value.

 

Algorithm Used: AES/CBC/PKCS5Padding

 

Also, If I use a static string for the IV, there is a CWE-321 Use of Hard-Coded Cryptographic key and CWE-329 Not using a Random IV vulnerability.

 

Please Advise.

  • 16 answers
  • 14.74K views

  • chethan (Community Member)

    Hi Hemant,

    I did refer to that material before. I still didn't find any help in regards to my scenario as explained above.

    • Boy, Security Consultant (Veracode)

      For AES/CBC/PKCS5Padding we strongly recommend using a random IV value at the time of encryption.

      For decryption though, you will need the same IV as was used for encryption.

       

      Typically this is prepended to the encrypted value and during encryption use the IV from the decrypted value. However, this will not provide integrity or authenticity (see also: https://security.stackexchange.com/a/217865/3206 ).

       

      As Mansi mentioned in her blog post:

      > **Most of the data you would want to protect is going to be online or travel through the internet. To safeguard this sensitive data, you should use Authenticated Encryption such as AES-GCM or ChaCha20-Poly1305 schemes and start moving away from any unauthenticated modes of operations (yes CBC is unauthenticated as well). This has been discussed in Symmetric Encryption section of Java Crypto Catchup post.

       

      If you do not have a separate mechanism for Authenticated Encryption, we recommend switching to GCM:

       

      // This is the only transformation string that would work.

      // AES/GCM/PKCS5Padding will throw an exception.

      Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");

       

      Thank you,

      Boy Baukema

      Expand Post

  • Sxie020473 (Community Member)

    I also got the same flaw in following pieces code at line val ivSpec = new GCMParameterSpec(TAG_BIT_LENGTH, iv_bytes)

     

    What is the solution for this? @Boy, Security Consultant (Veracode)​  @HemantShah (Community Member)​ @chethan (Community Member)​ 

     

    val InstanceGCMNoPadding = "AES/GCM/NoPadding"

    val AES_ENC_ALGO = "AES"

    val IV_BIT_LENGTH = 64

    val TAG_BIT_LENGTH = 128

     

    val sha256 = MessageDigest.getInstance("SHA-256")

    sha256.update((salt + password).getBytes())

    val key = sha256.digest()

    val keySpec = new SecretKeySpec(key, AES_ENC_ALGO)

    val iv_bytes = new SecureRandom().generateSeed(IV_BIT_LENGTH)

    val ivSpec = new GCMParameterSpec(TAG_BIT_LENGTH, iv_bytes)

    val salt_bytes = salt.getBytes(StandardCharsets.UTF_8)

    val secureRandom = SecureRandom.getInstance("DRBG",

    DrbgParameters.instantiation(256,

    DrbgParameters.Capability.PR_AND_RESEED,

    salt_bytes))

     

    val cipher = Cipher.getInstance(instance)

    cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec, secureRandom)

    cipher.updateAAD(salt_bytes)

    val utf8 = decrypted.getBytes(StandardCharsets.UTF_8)

     

    val encrypted = cipher.doFinal(utf8)

     

    Expand Post

    • Boy, Security Consultant (Veracode)

      The iv_bytes look to be correctly generated.

      I would recommend you contact our technical support team. Here's how you can log a case:

      1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

      2. Select Contact Support from the drop-down menu.

       

      Thank you,

      Boy Baukema

      Expand Post

      • JCambon015668 (Community Member)

        Hello,

         

        I have the same problem with the same piece of code, would it be possible to share the result of your investigation? Or should I open another ticket?

        Thanks,

        Regards

        Expand Post

  • Sxie020473 (Community Member)

    I changed val IV_BIT_LENGTH to 128, the flaw is still there. How to fix this?

10 of 16

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.