Venoma icon indicating copy to clipboard operation
Venoma copied to clipboard

Static IV Usage in AES Encryption

Open spblue4422 opened this issue 6 months ago • 0 comments

Hi, I've noticed that the AES encryption implementation in this repository uses a fixed IV value (e.g., 16 * b'\x00'). Using a static IV in modes like CBC can lead to serious security vulnerabilities, as it allows attackers to detect patterns in encrypted data and potentially decrypt or manipulate it. According to cryptographic best practices, IVs should be randomly generated for each encryption operation to ensure confidentiality and prevent attacks.

Would it be possible to update this in future releases by replacing the static IV with a secure, randomly generated IV? The line that I noticed is as follows.

https://github.com/ProcessusT/Venoma/blob/c638d3656930e3f1f5c7a4eb1f037585dc0976f7/aes.py#L14-L15

spblue4422 avatar Apr 09 '25 06:04 spblue4422