High severityC#CryptographyHIGH confidence
Hardcoded Key IV
A cryptographic key or IV is assigned from a hard-coded literal (byte array, encoded string, or base64) (CWE-321).
Standards mapping
- OWASP Top 10
- A02:2021 - Cryptographic Failures
- OWASP ASVS
- V6.4.1 (L2)
Vulnerable vs. safe
Flagged by this check
alg.Key = new byte[] { 0x01, 0x02, 0x03, 0x04 };Passes - the safe pattern
alg.GenerateKey();Why it matters & how to fix it
A cryptographic key or IV is assigned from a hard-coded literal (byte array, encoded string, or base64) (CWE-321). Embedded keys leak through source control and binaries and cannot be rotated without a redeploy. Derive keys from a secrets manager/KMS or a KDF, and generate a fresh random IV per message with RandomNumberGenerator.
References
Rule ID integsec.csharp.crypto.hardcoded-key-iv - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - CryptographyInsecure Randomness For Secrets
- JavaScript / TypeScript - CryptographyWeak Cipher Algorithm
- JavaScript / TypeScript - CryptographyWeak Hash Algorithm
- Python - CryptographyInsecure Random Token
- Python - CryptographyWeak Cipher DES ECB
- Python - CryptographyWeak Hash MD5 SHA1