Static IV (ARCH4114)

Key java.security.static-iv · Severity error · Category security · CWE CWE-329

A hardcoded or zero IV/nonce destroys semantic security in CBC, CTR, and GCM modes; the same plaintext always produces the same ciphertext and patterns leak.

Incorrect

byte[] iv = new byte[16]; // all zeros
Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(iv));

Correct

byte[] iv = new byte[16];
SecureRandom.getInstanceStrong().nextBytes(iv);
Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(iv));

Fix

Generate a unique, random IV with SecureRandom for each encryption and store it alongside the ciphertext.