Carelessness versus craftsmanship in cryptography

Summary: Trail of Bits found that the AES libraries aes-js and pyaes supply a default IV of 0x00000000_00000000_00000000_00000001 when none is given in CTR mode, and their documentation shows this as normal use, producing key/IV reuse bugs across projects that npm and GitHub estimate at 850 dependents and over 700,000 repositories for aes-js and nearly 23,000 for pyaes. The maintainers of aes-js and pyaes, neither updated since 2018 and 2017 respectively, dismissed a 2022 issue about the default IV with 'yadda, yadda, yadda' and did not respond to Trail of Bits' November 2025 outreach, while strongSwan's Tobias Brunner fixed the affected strongMan VPN management suite, which encrypted PKCS#8 keys and X.509 certificates in a SQLite database under one key/IV pair, and shipped migration tools and a security advisory.
Key Takeaway: Anyone holding a strongMan SQLite file could recover the keystream from the known X.509 data and decrypt the private keys, letting them impersonate every user whose certificates were stored there and mount person-in-the-middle attacks - and the libraries behind it still ship the default IV in their examples.

Read the original at Trail of Bits Blog ↗