rspec/rules/S3329/description.adoc

15 lines
664 B
Plaintext
Raw Normal View History

2020-06-30 12:48:39 +02:00
In encryption, when Cipher Block Chaining (CBC) is used, the Initialization Vector (IV) must be random and unpredictable. Otherwise, the encrypted value is vulnerable to crypto-analysis attacks such as the "Chosen-Plaintext Attack".
2021-02-02 15:02:10 +01:00
2020-06-30 12:48:39 +02:00
An IV value should be associated to one, and only one encryption cycle, because the IV's purpose is to ensure that the same plaintext encrypted twice will yield two different ciphertexts.
2021-02-02 15:02:10 +01:00
2020-06-30 12:48:39 +02:00
To that end, IV's should be:
2020-06-30 12:48:39 +02:00
* random
* unpredictable
* publishable (IVs are frequently published)
* authenticated, along with the ciphertext, with a Message Authentication Code (MAC)
This rule raises an issue when the IV is hard-coded.