CWE-329: Generation of Predictable IV with CBC Mode

Description:
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

Extended Description:
CBC mode eliminates a weakness of Electronic Code
	   Book (ECB) mode by allowing identical plaintext blocks to
	   be encrypted to different ciphertext blocks. This is
	   possible by the XOR-ing of an IV with the initial plaintext
	   block so that every plaintext block in the chain is XOR'd
	   with a different value before encryption. If IVs are
	   reused, then identical plaintexts would be encrypted to
	   identical ciphertexts. However, even if IVs are not
	   identical but are predictable, then they still break the
	   security of CBC mode against Chosen Plaintext Attacks
	   (CPA).

Affected languages: Not Language-Specific
Affected technologies: ICS/OT
Parent weaknesses: CWE-1204, CWE-573

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] NIST recommends two methods of generating unpredictable IVs for CBC mode [REF-1172]. The first is to generate the IV randomly. The second method is to encrypt a nonce with the same key and cipher to be used to encrypt the plaintext. In this case the nonce must be unique but can be predictable, since

Demonstrative examples:
In the following examples, CBC mode is used when encrypting data:
In both of these examples, the initialization vector (IV) is always a block of zeros. This makes the resulting cipher text much more predictable and susceptible to a dictionary attack.
EVP_CIPHER_CTX ctx; char key[EVP_MAX_KEY_LENGTH]; char iv[EVP_MAX_IV_LENGTH]; RAND_bytes(key, b); memset(iv,0,EVP_MAX_IV_LENGTH); EVP_EncryptInit(&ctx,EVP_bf_cbc(), key,iv);
public class SymmetricCipherTest { 
                         public static void main() { 
                               
                                  byte[] text ="Secret".getBytes(); byte[] iv ={ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 }; KeyGenerator kg = KeyGenerator.getInstance("DES"); kg.init(56); SecretKey key = kg.generateKey(); Cipher cipher = Cipher.getInsta

Real-world examples:
  - CVE-2020-5408: encryption functionality in an authentication framework uses a fixed null IV with CBC mode, allowing attackers to decrypt traffic in applications that use this functionality
  - CVE-2017-17704: messages for a door-unlocking product use a fixed IV in CBC mode, which is the same after each restart
  - CVE-2017-11133: application uses AES in CBC mode, but the pseudo-random secret and IV are generated using math.random, which is not cryptographically strong.
  - CVE-2007-3528: Blowfish-CBC implementation constructs an IV where each byte is calculated modulo 8 instead of modulo 256, resulting in less than 12 bits for the effective IV length, and less than 4096 possible IV va
  - CVE-2011-3389: BEAST attack in SSL 3.0 / TLS 1.0. In CBC mode, chained initialization vectors are non-random, allowing decryption of HTTPS traffic using a chosen plaintext attack.