tree 1acd211630b8640cd296b0520e0a11fee743a378
parent 2c421cedfba41f021fa75916e0fbd8f9d65f13e1
author Jacques Le Roux <jacques.le.roux@les7arts.com> 1626857643 +0200
committer Jacques Le Roux <jacques.le.roux@les7arts.com> 1626857749 +0200

Fixed: Static initialization vectors for encryption (OFBIZ-12281)

(after discussing this on security@ofbiz.apache.org, it was decided to open a
Jira issue for that)

I've noticed that OFBiz Framework sometimes uses static initialization vectors
(IV) while creating a cipher:

https://s.apache.org/vhlbj
https://s.apache.org/nyndk

IVs should be unique and ideally unpredictable to avoid producing the same
ciphertexts for the same plaintexts.

The issues can be fixed with something like the following:

byte[] rawIV = new byte[8];
SecureRandom random = new SecureRandom();
random.nextBytes(rawIV).
IvParameterSpec iv = new IvParameterSpec(rawIV);

jleroux: we prepend the IV in order to decrypt the plaintexts. I'll do
something similar in ValueLinkApi class ASAP

Thanks: Artem Smotrakov