Veracode Base Camp — YashSheggem165840 (Community Member) asked a question.
Hlo Veracode camp @Boy, Security Consultant (Veracode) @Shuning, Veracode Community Manager (Veracode) , can u forward to reach so that i can get a quick reply
Veracode Report gave in description for this issue as disclosure of sensitive information,I used AES Algorithm for Encryption and Decryption.(As we know in AES(symmetric algoritm) where key is same in both(encryption and decryption) for generating that key we used a string to AES standard key.
setKey(secret){setting AES key here}
String Encrypt(key,secret){ setKey(secret)//AES/GCM/NoPadding}
String Decrypt(key,secret){setKey(secret)//AES/GCM/NoPadding}
I used Standard AES Algorithm but this is showing the CWE ID 327 at this line in decryption:
GcmParameterSpec iv = new GcmParameterSpec(tag_length,iv)//tag_length 128 i used and iv - intialiazation vector (here in decryption i taken from encrypted strng which i added while returning enc string)
Iam a Java Devloper and new to veracode and did a veracode scan on my application iam getting this issue ,so Please kind ful if any thing i missing , please gave any helpful suggestion , i struck here for 3 days.
Sorry if any mistakes in above and i gone through @Mansi_Sh (Community Member) articles before this not got solved
Thanks
Veracode camp
.png){kind=logo}
Hi @YashSheggem165840 (Community Member) ,
For urgent issues I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Or schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
thanks hope it will solve
How to resolve this? I also got the same issue here. @YashSheggem165840 (Community Member) @Boy, Security Consultant (Veracode)
I changed val iv_bytes = new SecureRandom().generateSeed
(64)to (128). The flaw is still there, how to fix this?To make the warning go away, you need to use 96bits for the IV.
GCM is used to encode a stream of blocks where each block gets it's own secret by appending a 32bit block number to the base. This effectively reduces the randomness by 25% with the nice effect that you can decode any block directly (i.e. without decoding all the blocks that came before it).
But if you encode only a single block, then you're wasting 25% of the security which you could achieve because if the IV is smaller than 128 bits, it gets padded to 128 by appending the number 1 (hex 0x00000001). So 25% of the secret is known to an attacker.
I feel this is a flaw in VeraCode. They should only warn if the IV is < 96 bits. Both 96 and 128 bits should be valid.
Made this a suggestion for VeraCode: https://community.veracode.com/s/idea/0873n000000TkJJAA0/detail
Please chime in if this matters to you.