oblum428103 (Community Member) asked a question.
Decrypt AES Gcm Passing the IV
Veracode flags the the AES decryot when passing the IV from the encrypted message.
The example provided in https://www.veracode.com/blog/research/encryption-and-decryption-java-cryptography is flawed. When I decoupling the decrypt from the generation GCMParameterSpec , not as the example where the IV is generated in the the same source.
Passing through Veracode scan flags the IV as not random.
The IV can only be generated once per encryption and then used to decrypt. Cannot decrypt the text using a different IV value.
I have seen this issue posted several times with no apparent answer.
.png){kind=logo}
Hi @oblum428103 (Community Member) ,
Yes, Veracode Static Analysis will also report CWE 327 for DECRYPT_MODE, though in this mode you should not use a random value but the original value.
Veracode Engineering have reviewed this and determined that it is currently infeasible to detect this automatically in a performant way. They recommend documenting this as a Potential False Postive. You can read more on how to do this here: https://docs.veracode.com/r/improve_mitigation . Please note that this requires access to the Veracode Platform or the IDE plugin and you must reach out to your security team to request approval, they do not get an automatic notification.
Please also consider providing your ideas on this at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema