1989
KeyGenerator kg = KeyGenerator.getInstance("DES");
kg.init(56);
SecretKey key = kg.generateKey();
Cipher cipher = Cipher.getInstance("DES/CBC/PKCS5Padding");
IvParameterSpec ips = new IvParameterSpec(iv);
cipher.init(Cipher.ENCRYPT_MODE, key, ips);
return cipher.doFinal(inpBytes);
}
}
In both of these examples, the initialization vector (IV) is always a block of zeros. This makes the
resulting cipher text much more predictable and susceptible to a dictionary attack.
Example 2:
The Wired Equivalent Privacy (WEP) protocol used in the 802.11 wireless standard only supported
40-bit keys, and the IVs were only 24 bits, increasing the chances that the same IV would be
reused for multiple messages. The IV was included in plaintext as part of the packet, making it
directly observable to attackers. Only 5000 messages are needed before a collision occurs due
to the "birthday paradox" [REF-1176]. Some implementations would reuse the same IV for each
packet. This IV reuse made it much easier for attackers to recover plaintext from two packets with
the same IV, using well-understood attacks, especially if the plaintext was known for one of the
packets [REF-1175].
Observed Examples
Reference Description
CVE-2020-1472 ZeroLogon vulnerability - use of a static IV of all zeroes in AES-CFB8 mode
https://www.cve.org/CVERecord?id=CVE-2020-1472
CVE-2011-3389 BEAST attack in SSL 3.0 / TLS 1.0. In CBC mode, chained initialization
vectors are non-random, allowing decryption of HTTPS traffic using a chosen
plaintext attack.
https://www.cve.org/CVERecord?id=CVE-2011-3389
CVE-2001-0161 wireless router does not use 6 of the 24 bits for WEP encryption, making it
easier for attackers to decrypt traffic
https://www.cve.org/CVERecord?id=CVE-2001-0161
CVE-2001-0160 WEP card generates predictable IV values, making it easier for attackers to
decrypt traffic
https://www.cve.org/CVERecord?id=CVE-2001-0160
CVE-2017-3225 device bootloader uses a zero initialization vector during AES-CBC
https://www.cve.org/CVERecord?id=CVE-2017-3225
CVE-2016-6485 crypto framework uses PHP rand function - which is not cryptographically
secure - for an initialization vector
https://www.cve.org/CVERecord?id=CVE-2016-6485
CVE-2014-5386 encryption routine does not seed the random number generator, causing the
same initialization vector to be generated repeatedly
https://www.cve.org/CVERecord?id=CVE-2014-5386
CVE-2020-5408 encryption functionality in an authentication framework uses a fixed null IV with
CBC mode, allowing attackers to decrypt traffic in applications that use this
functionality
https://www.cve.org/CVERecord?id=CVE-2020-5408
CVE-2017-17704 messages for a door-unlocking product use a fixed IV in CBC mode, which is
the same after each restart
https://www.cve.org/CVERecord?id=CVE-2017-17704
CVE-2017-11133 application uses AES in CBC mode, but the pseudo-random secret and IV are
generated using math.random, which is not cryptographically strong.
https://www.cve.org/CVERecord?id=CVE-2017-11133
CWE Version 4.14
CWE-1204: Generation of Weak Initialization Vector (IV)
CWE-1204: Generation of Weak Initialization Vector (IV)