CAS-005: CompTIA SecurityX

Question

A recent SAST scan of an application that supplies an encrypted tunnel between sites detected the following vulnerability:

Cipher Block Chaining Initialization Vector must be unpredictable.

The vulnerability was identified on these source-code lines:

iv = b"CompTIAIV202512"  
cipher= Cipher(Algorithms.AES(key), modes.CBC(iv))

Which of the following is a potential impact of this vulnerability?

Explanation

CBC requires an unpredictable IV for each encryption operation because the IV is combined with the first plaintext block. A fixed, predictable IV removes this protection and can enable confidentiality attacks that reveal or allow inference of protected plaintext. NIST SP 800-38A specifies that CBC IVs need not be secret but must be unpredictable.

Learn more

NIST SP 800-38A: Recommendation for Block Cipher Modes of Operation

CAS-005: CompTIA SecurityX

AstroTutor

Notes

Readiness

QuestionQ2

Community Discussion