Hi all, I am using SonarQube 6.7.5 with java plugin 5.7 (build 15470) I analyze these source code with SonarLint Eclipse: import java.security.InvalidAlgorithmParameterException; import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.security.SecureRa…

This is a tricky one : The rule is implemented rather naively and not relying on the context where the IV is used. When used in decrypt it is safe to not randomly initialized it. So, contrary to what @Lena mentioned (sorry mate :wink: ) it is safe in your case. The rule just check that when you c…

Hi, Your upgrade of SonarLint also upgraded the embedded analyzers. That’s why you’re benefiting from new rules. As for how to solve this, have you checked out the rule description? :slight_smile: Ann

Is embedded analyzers that you mentioned is Sonar-java plugin? [image] ganncamp: As for how to solve this, have you checked out the rule description? I have read the description and resolved this rules before by using the codes I share, and it was closed. But after I upgrade SonarLint to 4 (…

Hi @fanny_tan I think we should forget about SonarLint here and just understand the current state of analysis. In the code snippet you provided, there are 2 new IvParameterSpec(...), in encrypt and decrypt. In encrypt you are using a secure way to init initVector: (new SecureRandom()).nextBytes(i…

Thank you so much @Nicolas_Peru :smile:

How to resolve rules "Cypher Block Chaining IV's should be random and unique"

SonarQube Server / Community Build

fanny_tan (Fanny Tan) February 12, 2019, 5:08am 7

@Lena Thank you.

Right now I think I will try to fix the issues. Do you have an example of how to fixed this decrypt issues?

Topic		Replies	Views
Cipher Block Chaining IV's should be unpredictable (java:S3329) Report False-positive / False-negative... java , sonarqube , sonarqube-ide	3	3261	January 10, 2022
S3329 "Use a dynamically-generated, random IV." FP SonarQube Cloud csharp , security , sonarqube-cloud	14	7268	March 8, 2021
Use a dynamically-generated, random IV SonarQube Cloud java , sonarqube , scanner , sonarqube-cloud	2	8069	January 10, 2022
FP on S3329 (Cipher IV unpredictable) on DECRYPT_MODE if IV variable declaration is split from definition Report False-positive / False-negative... java , sonarqube , security	3	1096	April 8, 2022
False positive or false negative? I don't care which but consistency would be real nice as a minimum SonarQube Server / Community Build java , sonarqube , security	3	1241	August 31, 2020

How to resolve rules "Cypher Block Chaining IV's should be random and unique"

Related topics