CBC Encryption with Fixed IV in Encrypt Function

[nyxfqq]

Describe the problem

I've discovered that the CBC encryption mode implemented in the Encrypt function located in the crypt.go file (part of the github.com/netbirdio/netbird/management/server/activity/sqlite package) utilizes a static initialization vector (IV). This practice is known to compromise the security of the encrypted data, as using a predictable IV can lead to pattern leaks and potentially allow attackers to infer information about the plaintext.

Expected behavior

For security purposes, each encryption operation should utilize a unique and unpredictable IV, maybe it can derived from the key.

NetBird version

<=0.28.4

Screenshots

      var iv = []byte{10, 22, 13, 79, 05, 8, 52, 91, 87, 98, 88, 98, 35, 25, 13, 05}
      func (ec *FieldEncrypt) Encrypt(payload string) string {
          plainText := pkcs5Padding([]byte(payload))
          cipherText := make([]byte, len(plainText))
          cbc := cipher.NewCBCEncrypter(ec.block, iv)
          cbc.CryptBlocks(cipherText, plainText)
          return base64.StdEncoding.EncodeToString(cipherText)
      }

[lixmal]

Hi @nyxfqq,

thanks for reporting this. We work on a migration to some authenticated encryption cipher with proper iv usage.