2023-05-03 11:06:20 +02:00
|
|
|
== Why is this an issue?
|
|
|
|
|
|
2020-06-30 12:48:39 +02:00
|
|
|
include::../description.adoc[]
|
|
|
|
|
|
2023-05-03 11:06:20 +02:00
|
|
|
=== Noncompliant code example
|
2020-06-30 12:48:39 +02:00
|
|
|
|
2022-02-04 17:28:24 +01:00
|
|
|
[source,apex]
|
2020-06-30 12:48:39 +02:00
|
|
|
----
|
|
|
|
|
Blob cryptoKey = Crypto.generateAesKey(256);
|
|
|
|
|
Blob hardcoded_iv = Blob.valueOf('hardcoded IV');
|
|
|
|
|
Blob data = Blob.valueOf('some secret data');
|
|
|
|
|
Blob encryptedData = Crypto.encrypt('AES256', hardcoded_iv, key, data); // Noncompliant, the IV is hardcoded
|
|
|
|
|
----
|
|
|
|
|
|
2023-05-03 11:06:20 +02:00
|
|
|
=== Compliant solution
|
2020-06-30 12:48:39 +02:00
|
|
|
|
2022-02-04 17:28:24 +01:00
|
|
|
[source,apex]
|
2020-06-30 12:48:39 +02:00
|
|
|
----
|
|
|
|
|
Blob cryptoKey = Crypto.generateAesKey(256);
|
|
|
|
|
Blob data = Blob.valueOf('some secret data');
|
|
|
|
|
Blob encryptedData = Crypto.encryptWithManagedIV('AES256', key, data);
|
|
|
|
|
----
|
|
|
|
|
|
2023-05-03 11:06:20 +02:00
|
|
|
== Resources
|
2020-06-30 12:48:39 +02:00
|
|
|
|
2021-11-01 15:00:32 +01:00
|
|
|
* https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[OWASP Top 10 2021 Category A2] - Cryptographic Failures
|
2022-07-08 13:58:56 +02:00
|
|
|
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration
|
2022-04-07 08:53:59 -05:00
|
|
|
* https://cwe.mitre.org/data/definitions/329[MITRE, CWE-329] - CWE-329: Not Using an Unpredictable IV with CBC Mode
|
|
|
|
|
* https://cwe.mitre.org/data/definitions/330[MITRE, CWE-330] - Use of Insufficiently Random Values
|
2021-04-26 17:29:13 +02:00
|
|
|
* https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf[NIST, SP-800-38A] - Recommendation for Block Cipher Modes of Operation
|
2020-06-30 12:48:39 +02:00
|
|
|
* https://developer.salesforce.com/page/Apex_Crypto_Class[Using the Apex Crypto Class]
|
2021-06-02 20:44:38 +02:00
|
|
|
|
2021-06-03 09:05:38 +02:00
|
|
|
ifdef::env-github,rspecator-view[]
|
2021-09-20 15:38:42 +02:00
|
|
|
|
|
|
|
|
'''
|
|
|
|
|
== Implementation Specification
|
|
|
|
|
(visible only on this page)
|
|
|
|
|
|
2023-05-25 14:18:12 +02:00
|
|
|
=== Message
|
|
|
|
|
|
|
|
|
|
Use "encryptWithManagedIV" instead of providing a hardcoded IV
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
=== Highlighting
|
|
|
|
|
|
|
|
|
|
the initialization vector parameter
|
2021-09-20 15:38:42 +02:00
|
|
|
|
|
|
|
|
|
2021-06-08 15:52:13 +02:00
|
|
|
'''
|
2021-06-02 20:44:38 +02:00
|
|
|
== Comments And Links
|
|
|
|
|
(visible only on this page)
|
|
|
|
|
|
|
|
|
|
include::../comments-and-links.adoc[]
|
2021-06-03 09:05:38 +02:00
|
|
|
endif::env-github,rspecator-view[]
|
