# Hardcoded IV / Nonce

> Detects static or hardcoded Initialization Vectors (IV) or nonces in symmetric encryption, breaking confidentiality.

- Skill: `zakirkun/hardcoded-iv-nonce` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/hardcoded-iv-nonce`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/hardcoded-iv-nonce/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/hardcoded-iv-nonce

---


# Hardcoded IV / Nonce

## Overview
A static or predictable Initialization Vector (IV) in block cipher modes (CBC, CTR, GCM) critically weakens encryption:
- **CBC with fixed IV**: Two identical plaintexts produce identical ciphertexts, leaking information
- **CTR/GCM with reused nonce**: Nonce reuse in CTR/GCM allows key recovery and plaintext XOR

The IV/nonce must be **randomly generated** for each encryption operation and stored alongside the ciphertext.

## Detection Strategy
- Zero-filled IV: `\x00\x00...\x00` or `iv = bytes(16)`
- Hardcoded IV bytes: `iv = b'\x01\x02\x03...'`
- Derived from static string: `iv = "hardcoded_iv____".encode()`

## Remediation
Generate a cryptographically random IV for every encryption operation.

**Vulnerable (Python):**
```python
from Crypto.Cipher import AES
iv = b'\x00' * 16  # Static zero IV!
cipher = AES.new(key, AES.MODE_CBC, iv)
```

**Safe (Python):**
```python
import os
from Crypto.Cipher import AES
iv = os.urandom(16)  # Random IV
cipher = AES.new(key, AES.MODE_CBC, iv)
ciphertext = iv + cipher.encrypt(plaintext)  # Prepend IV to output
```