DerScanner
Home / Vulnerability Database / Objective-C : Null initialization vector
Objective-C

Objective-C : Null initialization vector

Classification

OWASP Mobile Top 10 2014
M6-Broken Cryptography
OWASP Mobile Top 10 2016
M5-Insufficient Cryptography
OWASP MASVS
V3: 3.3.(L1/L2/L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored Cryptography
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-329

Overview

The application performs encryption with null initialization vector (IV). In case of encrypting related messages with the same key an attacker can obtain information about the message. For secure encryption it is necessary for the IV to be cryptographically pseudorandom, that is, unpredictable to an attacker.

Insufficient Cryptography vulnerabilities take the fifth place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.

References

  1. CWE-329: Not Using a Random IV with CBC Mode
  2. Initialization vector - Wikipedia
  3. Forced into using a static IV (AES) - security.stackexchange.com
  4. Why should I use an Initialization Vector (IV) when I have unique keys? - crypto.stackexchange.com
  5. Mobile Top 10 2016-M5-Insufficient Cryptography
CRITICAL

DerScanner Severity Score

Do you want to fix Objective-C : Null initialization vector in your application?

See also

Objective-C

Objective-C : Internal information leak

Objective-C

Objective-C : Weak hashing algorithm

Objective-C

Objective-C : Unsafe reflection