Cryptographic API Misuse Vulnerability : Do not use non-random/static)predictable IVs in CBC

[gxx777]

Hello,
Thanks for maintaining the repository. Our team is a research organization focusing on cryptographic engineering. Recently, we discovered the potential risks by our Python Cryptographic APIs misuse detector:

Description:

It utilizes a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. Using default predictable IVs can lead to vulnerabilities like the disclosure of information about the plaintext of subsequent messages. b"0102030405060708"

Location:

https://github.com/darknessomi/musicbox/blob/master/NEMbox/encrypt.py#L50

Reference

• CWE-329: Generation of Predictable IV with CBC Mode；
• CWE-330: Use of Insufficiently Random Values

Expected Behavior:

The IV for CBC mode should be random and unpredictable for each encryption operation to ensure the security of the encryption scheme.

Actual Behavior:

the fork repo python-spider also miuses it.
https://github.com/Jack-Cherish/python-spider/blob/master/Netease/Netease.py#L33

Jack-Cherish/python-spider#127

A static IV is used across encryption operations, making the encrypted data less secure and potentially leading to patterns that can be exploited by attackers. Default--> b"0102030405060708"

Recommendation

Do not set default constant iv for CBC encryption. And modify the encryption process to generate a random IV each time an encryption operation is performed.

[huzpsb]

But no changes can be made without breaking this tool...Are you really reviewing the results of your scan tool?