Use a randomly-generated IV

Docs > コード分析 > Static Analysis Rules > Use a randomly-generated IV

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: java-security/random-iv

Language: Java

Severity: Warning

Category: Security

CWE: 1204

Description

The initialization vector (IV) for a cryptographic operation must be random and not statically declared. Instead of using a static initialization vector, use the SecureRandom class that will initialize your vector with real random values.

Learn More

Non-Compliant Code Examples

public class Foo {
    void bad() {
        byte[] iv = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, };
    }

    void alsoBad() {
        byte[] iv = "secret iv in here".getBytes();
    }
}

Compliant Code Examples

public class Foo {
    void good() {
        SecureRandom random = new SecureRandom();
        byte iv[] = new byte[16];
        random.nextBytes(bytes);
    }
}