# Crypto parameter and IV misuse

Configured crypto parameters silently overridden: IV/nonce ordering, protocol disablement, unauthenticated re-keying

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2021-03-07. Updated 2026-11-01._

## How it works
Crypto APIs let a caller set a parameter at a level or in an order that does not actually control the primitive. The assumption that breaks is "the value I set is the value used." A random IV set before the key is silently discarded and a static nonce is used instead [E2](https://bugbountylibrary.com/r/h1%3A170548.md). Disabling ciphers is assumed to disable the protocol, but the protocol still handshakes [E3](https://bugbountylibrary.com/r/h1%3A166634.md). A trust key bootstrapped out of band is assumed to be authoritative, but any incoming message can overwrite it [E1](https://bugbountylibrary.com/r/h1%3A423467.md). In each case the safe-looking configuration does not bind to the operation that matters.

## Where it shows up
- AEAD setup where IV/nonce is assigned before the key, or ordering is undocumented [E2](https://bugbountylibrary.com/r/h1%3A170548.md)
- Identical ciphertext across runs with fixed plaintext/key despite a printed random IV [E2](https://bugbountylibrary.com/r/h1%3A170548.md)
- Protocol disablement done only by removing ciphers, with no protocol-level kill switch [E3](https://bugbountylibrary.com/r/h1%3A166634.md)
- Key-setter reachable from a message-type switch that skips decryption/ACK verification first [E1](https://bugbountylibrary.com/r/h1%3A423467.md)
- Trust bootstrapped from a QR code or pairing step, then re-keyable over the network [E1](https://bugbountylibrary.com/r/h1%3A423467.md)

## How to review
For each primitive, confirm the parameter actually in force equals the one configured: encrypt fixed plaintext/key twice and compare ciphertexts (must differ) [E2](https://bugbountylibrary.com/r/h1%3A170548.md). For protocol disablement, attempt the protocol handshake directly, not just the cipher list [E3](https://bugbountylibrary.com/r/h1%3A166634.md). For key exchange, trace every call path to the key-setter and require that re-keying only happens after the peer proves it can decrypt (ACK) [E1](https://bugbountylibrary.com/r/h1%3A423467.md). The invariant: no unauthenticated message may change key material, and no configured crypto parameter may be silently overridden.

## How finders spotted it
- Read the AEAD docs, noticed key/IV ordering unspecified, then tested setting random_iv before key; identical ciphertext across runs with different printed IVs revealed the static nonce [E2](https://bugbountylibrary.com/r/h1%3A170548.md)
- DROWN research showed servers still answering SSLv2 despite cipher-level disabling, prompting inspection of the protocol-vs-cipher disable logic [E3](https://bugbountylibrary.com/r/h1%3A166634.md)
- Decompiled the apps, noticed a 0.0.0.0:5000 listener and a wifi-IP connection string, then traced that both start() and receiveMessageFromServer() call setReceiverPublicKey(), spotting the unvalidated override path [E1](https://bugbountylibrary.com/r/h1%3A423467.md)

## Variants seen
- Static nonce from IV-before-key ordering in Ruby OpenSSL GCM [E2](https://bugbountylibrary.com/r/h1%3A170548.md)
- Protocol still negotiated after cipher-level disable (SSLv2/DROWN) [E3](https://bugbountylibrary.com/r/h1%3A166634.md)
- Receiver public key overridable by any on-path message [E1](https://bugbountylibrary.com/r/h1%3A423467.md)

## Impact and severity
Led to session MITM and data tampering on a PoS channel [E1](https://bugbountylibrary.com/r/h1%3A423467.md), nonce reuse that enables two-time-pad recovery of GCM ciphertexts [E2](https://bugbountylibrary.com/r/h1%3A170548.md), and DROWN exposure despite hardening [E3](https://bugbountylibrary.com/r/h1%3A166634.md). Severity is high because the misconfiguration looks correct in review; the risk is greater when trust bootstrap and re-keying share one code path, since a single unvalidated setter then defeats the whole trust model [E1](https://bugbountylibrary.com/r/h1%3A423467.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Ruby**: Ruby OpenSSL Library - IV Reuse in GCM Mode. Report: https://bugbountylibrary.com/r/h1%3A170548.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A423467.md
- E2: https://bugbountylibrary.com/r/h1%3A170548.md
- E3: https://bugbountylibrary.com/r/h1%3A166634.md