hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed a few typos

Browse Source
This commit is contained in:
Fosstars
2021-08-08 12:50:04 +02:00
parent cfe74b527a
commit df0f9ee3a5
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.qhelp
View File

@@ -6,7 +6,7 @@
A cipher needs an initialization vector (IV) when it is used in certain modes A cipher needs an initialization vector (IV) when it is used in certain modes
such as CBC or GCM. Under the same secret key, IVs should be unique and ideally unpredictable. such as CBC or GCM. Under the same secret key, IVs should be unique and ideally unpredictable.
Given a secret key, if the same IV is used for encryption, the same plaintexts result in the same ciphertexts. Given a secret key, if the same IV is used for encryption, the same plaintexts result in the same ciphertexts.
This lets an attacker learn if the same data pieces are transfered or stored, This lets an attacker learn if the same data pieces are transferred or stored,
or this can help the attacker run a dictionary attack. or this can help the attacker run a dictionary attack.
</p> </p>
</overview> </overview>

2
java/ql/src/experimental/Security/CWE/CWE-1204/StaticInitializationVector.ql
View File

@@ -5,7 +5,7 @@
* therefore they should be unique and ideally unpredictable. * therefore they should be unique and ideally unpredictable.
* Otherwise, the same plaintexts result in same ciphertexts under a given secret key. * Otherwise, the same plaintexts result in same ciphertexts under a given secret key.
* If a static IV is used for encryption, this lets an attacker learn * If a static IV is used for encryption, this lets an attacker learn
* if the same data pieces are transfered or stored, * if the same data pieces are transferred or stored,
* or this can help the attacker run a dictionary attack. * or this can help the attacker run a dictionary attack.
* @kind path-problem * @kind path-problem
* @problem.severity warning * @problem.severity warning