Static IV (ARCH8114)

Key kotlin.security.static-iv · Severity error · Category security · CWE CWE-329

Flags IvParameterSpec / GCMParameterSpec built from a literal or a zero-filled array.

Incorrect

IvParameterSpec(ByteArray(16))

Correct

val iv = ByteArray(12).also { SecureRandom().nextBytes(it) }
GCMParameterSpec(128, iv)

Fix

Generate a random IV/nonce per encryption and store it with the ciphertext.