Skip to content

MASTG-TEST-0317: Broken Symmetric Encryption Modes

Overview

This test focuses on broken symmetric encryption modes such as ECB (Electronic Codebook).

For more information, please refer to use of broken encryption modes.

In iOS development, the more recent CryptoKit does not support ECB mode and is therefore not vulnerable to this issue, as it only supports secure encryption modes like AES-GCM and ChaCha20-Poly1305. However, applications may use the older CommonCrypto library or other third-party libraries that may support ECB mode. In this case, it is essential to verify that ECB mode is not being used.

In CommonCrypto, ECB mode can be enabled by setting the kCCOptionECBMode (value 0x0002 or 2) in the options parameter of the CCCrypt function. When kCCOptionECBMode is set in the options parameter, the encryption uses ECB mode, which is considered vulnerable. The default behavior (when kCCOptionECBMode is not set) is to use CBC mode, which is more secure when used with a proper initialization vector (IV).

Steps

  1. Use Reverse Engineering iOS Apps to reverse engineer the app.
  2. Use Retrieving Cross References to look for uses of symmetric encryption and its modes.
  3. Use Reviewing Disassembled Objective-C and Swift Code to analyze the relevant code paths and obtain the values for the encryption modes.

Observation

The output should contain the uses of symmetric encryption and its modes.

Evaluation

The test case fails if you can find the use of symmetric encryption with broken modes enabled, such as ECB mode.

Mitigations

Demos

MASTG-DEMO-0080: Uses of Broken Encryption Modes in CommonCrypto with r2