diff --git a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.qhelp b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.qhelp index 48c1b39d438..94192cd7c3b 100644 --- a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.qhelp +++ b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.qhelp @@ -3,7 +3,7 @@

When a cipher is used in certain modes (such as CBC or GCM), it requires an initialization vector (IV). Under the same secret key, IVs should be unique and ideally unpredictable. If the same IV is used with the same secret key, then the same plaintext results in the same ciphertext. This behavior may enable an attacker to learn if the same data pieces are transferred or stored, or help the attacker run a dictionary attack.

-

In particular, if the IV is hardcoded or constant, an attacker may just lookup potential keys in a dictionary, then concatenate those with the hardcoded or constant IV rather than trying to discover the entire encryption key.

+

In particular, if the IV is hardcoded or constant, an attacker may just look up potential keys in a dictionary, then concatenate those with the hardcoded or constant IV rather than trying to discover the entire encryption key.

diff --git a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql index 819d0748757..ccf6584c391 100644 --- a/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql +++ b/swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql @@ -1,6 +1,6 @@ /** * @name Static initialization vector for encryption - * @description Using a static initialization vector (IV) for encryption is not secure. To maximize encryption and prevent dictionary attacks, IVs should rather be unique and unpredictable. + * @description Using a static initialization vector (IV) for encryption is not secure. To maximize encryption and prevent dictionary attacks, IVs should be unique and unpredictable. * @kind path-problem * @problem.severity error * @security-severity 7.5