The encryption key with a value of null can result in an application compromise.

You should never use a null encryption key, since it significantly reduces the protection afforded by a good encryption algorithm, but also makes fixing the problem difficult. Information that it uses a null key encryption is accessible to at least every developer of the application. After the application is installed, the null encryption key can not be removed without updating the software. If an account that is protected by a NULL encryption key is compromised, system administrators will be forced either to neglect the safety, or to restrict the access to the application. Constant strings are easily extracted from the compiled application by decompilers. Therefore, it is not necessary for an attacker to have access to the source code, to determine that a null encryption key is used.

Insufficient Cryptography vulnerabilities take the fifth place in the “OWASP Top 10 2016” mobile application vulnerabilities ranking.

Objective-C : nil encryption key

DerScanner Severity Score

Do you want to fix Objective-C : nil encryption key in your application?

See also