Static initialization vector (ARCH312)

Key dotnet.security.static-iv · Severity error · Category security · CWE CWE-329

Reusing a fixed or zero IV breaks semantic security and allows comparison across ciphertexts. Generate a fresh random IV per encryption.

Incorrect

using var aes = Aes.Create();
aes.IV = new byte[16]; // all zeros, reused every time

Correct

using var aes = Aes.Create();
aes.GenerateIV(); // fresh random IV per message; store it alongside ciphertext

Fix

Generate a new IV per message with GenerateIV() or RandomNumberGenerator and store it with the ciphertext.