tree 9f1502971149a7cc20d8aff83121f09df12ccba0
parent c5a1a91fbd6fab79d47c353cc19befff850191a2
author Jacques Le Roux <jacques.le.roux@les7arts.com> 1627022751 +0200
committer Jacques Le Roux <jacques.le.roux@les7arts.com> 1627025425 +0200

Fixed: Static initialization vectors for encryption (OFBIZ-12281)

(after discussing this on security@ofbiz.apache.org, it was decided to open a
Jira issue for that)

I've noticed that OFBiz Framework sometimes uses static initialization vectors
(IV) while creating a cipher:

https://s.apache.org/vhlbj
https://s.apache.org/nyndk

IVs should be unique and ideally unpredictable to avoid producing the same
ciphertexts for the same plaintexts.

The issues can be fixed with something like the following:

byte[] rawIV = new byte[8];
SecureRandom random = new SecureRandom();
random.nextBytes(rawIV).
IvParameterSpec iv = new IvParameterSpec(rawIV);

jleroux: this prepends the IV in order to decrypt the plaintexts. It's similar
to what has been done for the DesCrypt class. But contrary to the DesCrypt class
I did not test.

Thanks: Artem Smotrakov