Skip to main content

Insecure generation of random numbers - Static IV

Need​

Secure generation of random numbers and dynamic initialization vectors

Context​

  • Usage of Go 1.16 for building high-performance and efficient applications
  • Usage of Gin framework for building web applications in Go

Description​

Non compliant code​

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"encoding/hex"
	"fmt"
	"github.com/gin-gonic/gin"
)

const (
	// Hardcoded Initialization Vector
	iv = "0123456789abcdef"
)

func main() {
	r := gin.Default()
	r.GET("/encrypt/:text", func(c *gin.Context) {
		text := c.Param("text")
		encrypted := encrypt(text)
		c.JSON(200, gin.H{
			"encrypted": encrypted,
		})
	})
	r.Run() // listen and serve on 0.0.0.0:8080
}

func encrypt(stringToEncrypt string) (encryptedString string) {

	key := []byte("0123456789abcdef")
	plaintext := []byte(stringToEncrypt)

	block, err := aes.NewCipher(key)
	if err != nil {
		panic(err.Error())
	}

	cfb := cipher.NewCFBEncrypter(block, []byte(iv))
	ciphertext := make([]byte, len(plaintext))
	cfb.XORKeyStream(ciphertext, plaintext)

	return fmt.Sprintf("%x", ciphertext)
}

The above code is a simple Go application using the Gin framework. It has an endpoint /encrypt/:text that accepts a string as a parameter and returns the encrypted version of the string.

The encryption is done using the AES cipher in Cipher Feedback Mode (CFB) with a static Initialization Vector (IV) and a static key. The encrypt function takes a string as input, converts it to bytes, and then encrypts it using the cipher.NewCFBEncrypter function. The encrypted bytes are then converted to a hexadecimal string and returned.

The vulnerability lies in the use of a static, hardcoded Initialization Vector (IV) for the encryption. The IV is meant to provide randomness to the encryption process and should be unique for each encryption operation. However, in this code, a static IV is used for all encryption operations. This means that the same plaintext will always result in the same ciphertext.

An attacker who knows this IV and has a pair of plaintext and corresponding ciphertext can potentially reverse engineer the key. This would allow them to decrypt any other ciphertext encrypted with the same key and IV, or even encrypt their own messages. This exposes the system to potential breaches and information leakage.

Steps​

  • Use a cryptographically secure random number generator to generate a unique initialization vector (IV) for each encryption operation.
  • Store the generated IV securely and ensure it is not hardcoded or easily guessable.
  • Update the code to retrieve the IV from a secure storage or generate it dynamically for each encryption operation.
  • Ensure that the IV is passed as a parameter to the encryption function.
  • Update the encryption function to accept the IV as a parameter and use it during the encryption process.
  • Make sure to update any other parts of the code that rely on the IV to use the new approach.
  • Test the updated code thoroughly to ensure it is functioning correctly and securely.

Compliant code​

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"github.com/gin-gonic/gin"
	"io"
)

func main() {
	r := gin.Default()
	r.GET("/encrypt/:text", func(c *gin.Context) {
		text := c.Param("text")
		encrypted, iv := encrypt(text)
		c.JSON(200, gin.H{
			"encrypted": encrypted,
			"iv":        iv,
		})
	})
	r.Run() // listen and serve on 0.0.0.0:8080
}

func encrypt(stringToEncrypt string) (encryptedString string, ivString string) {

	key := []byte("0123456789abcdef")
	plaintext := []byte(stringToEncrypt)

	block, err := aes.NewCipher(key)
	if err != nil {
		panic(err.Error())
	}

	// Generate a new IV each time for security
	iv := make([]byte, aes.BlockSize)
	if _, err := io.ReadFull(rand.Reader, iv); err != nil {
		panic(err.Error())
	}

	cfb := cipher.NewCFBEncrypter(block, iv)
	ciphertext := make([]byte, len(plaintext))
	cfb.XORKeyStream(ciphertext, plaintext)

	return fmt.Sprintf("%x", ciphertext), fmt.Sprintf("%x", iv)
}

The updated code now generates a new Initialization Vector (IV) for each encryption operation using a cryptographically secure random number generator. This IV is then used in the encryption process, replacing the previously hardcoded value.

The encrypt function now returns two values - the encrypted string and the IV used for encryption. The IV is returned as a hexadecimal string.

In the main function, the IV is included in the JSON response along with the encrypted string. This allows the recipient to know the IV used for encryption without it being hardcoded or easily guessable.

This approach significantly improves the security of the encryption process by ensuring that the IV is unique for each encryption operation and cannot be easily predicted by an attacker.

Please note that the key used for encryption is still hardcoded in this example. In a real-world application, you should also generate or securely store and retrieve this key in a similar manner to the IV.

Remember to thoroughly test your updated code to ensure it is functioning correctly and securely.

References​

Last updated on