Use initialization vectors once
Summary
The system should use initialization vectors, nonces and other single use numbers only once with a given encryption key.
Description
The system's cryptographic keys are essential for maintaining the confidentiality and integrity of transactions and communications. Some encryption mechanisms use initialization vectors to reduce the chances that a message will be decrypted. These vectors should be generated using cryptographically secure random number generators and should only be used once with a given encryption key.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CWE™-326. Inadequate encryption strength
- CERT-J-TSM02-J. Do not use background threads during class initialization
- CMMC-AC_L1-3_1_2. Transaction & function control
- CMMC-SC_L1-3_13_1. Boundary protection
- HITRUST CSF-09_y. On-line transactions
- HITRUST CSF-10_g. Key management
- ISO/IEC 27002-8_24. Use of cryptography
- OWASP ASVS-6_2_3. Algorithms
- OWASP ASVS-6_2_6. Algorithms
- ISO/IEC 27001-8_24. Use of cryptography
- CASA-6_2_3. Algorithms
- CASA-6_2_6. Algorithms
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.