Reusing a Nonce, Key Pair in Encryption
| Property | |
|---|---|
| Language | java |
| Severity |  |
| CWE | CWE-323: Reusing a Nonce, Key Pair in Encryption |
| OWASP | A02:2021 - Cryptographic Failures |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
When using AES-GCM encryption, reusing the same Initialization Vector (IV) with the same key for different messages makes the encryption predictable and insecure. Each encryption operation must use a new, unique IV to protect the data properly.
Impact#
If the same IV and key are reused, attackers can detect patterns between encrypted messages and may be able to recover sensitive information or compromise the integrity of the data. This could lead to data leaks or unauthorized access to confidential information.