hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-20 18:58:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

address docs review

Browse Source
This commit is contained in:
Karim Ali
2022-11-10 14:30:04 +02:00
parent b1679df3d2
commit d229d6a7cb
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.qhelp
View File

@@ -3,7 +3,7 @@
<overview>
<p>When a cipher is used in certain modes (such as CBC or GCM), it requires an initialization vector (IV). Under the same secret key, IVs should be unique and ideally unpredictable. If the same IV is used with the same secret key, then the same plaintext results in the same ciphertext. This behavior may enable an attacker to learn if the same data pieces are transferred or stored, or help the attacker run a dictionary attack.</p>
<p>In particular, if the IV is hardcoded or constant, an attacker may just lookup potential keys in a dictionary, then concatenate those with the hardcoded or constant IV rather than trying to discover the entire encryption key.</p>
<p>In particular, if the IV is hardcoded or constant, an attacker may just look up potential keys in a dictionary, then concatenate those with the hardcoded or constant IV rather than trying to discover the entire encryption key.</p>
</overview>
<recommendation>

2
swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Static initialization vector for encryption
* @description Using a static initialization vector (IV) for encryption is not secure. To maximize encryption and prevent dictionary attacks, IVs should rather be unique and unpredictable.
* @description Using a static initialization vector (IV) for encryption is not secure. To maximize encryption and prevent dictionary attacks, IVs should be unique and unpredictable.
* @kind path-problem
* @problem.severity error
* @security-severity 7.5