{"record":{"id":"956803dd782ebc95","repo":"peass-ng/PEASS-ng","slug":"iv-must-be-at-least-1-byte","errorCode":null,"errorMessage":"IV must be at least 1 byte","messagePattern":"IV must be at least 1 byte","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/modes/GcmBlockCipher.cs","lineNumber":131,"sourceCode":"            {\n                ParametersWithIV param = (ParametersWithIV)parameters;\n\n                newNonce = param.GetIV();\n                initialAssociatedText = null;\n                macSize = 16;\n                keyParam = (KeyParameter)param.Parameters;\n            }\n            else\n            {\n                throw new ArgumentException(\"invalid parameters passed to GCM\");\n            }\n\n            int bufLength = forEncryption ? BlockSize : (BlockSize + macSize);\n            this.bufBlock = new byte[bufLength];\n\n            if (newNonce == null || newNonce.Length < 1)\n            {\n                throw new ArgumentException(\"IV must be at least 1 byte\");\n            }\n\n            if (forEncryption)\n            {\n                if (nonce != null && Arrays.AreEqual(nonce, newNonce))\n                {\n                    if (keyParam == null)\n                    {\n                        throw new ArgumentException(\"cannot reuse nonce for GCM encryption\");\n                    }\n                    if (lastKey != null && Arrays.AreEqual(lastKey, keyParam.GetKey()))\n                    {\n                        throw new ArgumentException(\"cannot reuse nonce for GCM encryption\");\n                    }\n                }\n            }\n\n            nonce = newNonce;","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/modes/GcmBlockCipher.cs#L113-L149","documentation":"A nonce validation in GcmBlockCipher.Init: after extracting the nonce from AeadParameters or ParametersWithIV it must be non-null and at least one byte long, because GCM derives its counter block from the IV and an empty IV is undefined. It fires when the caller passes an empty or missing nonce array.","triggerScenarios":"Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/modes/GcmBlockCipher.cs:131 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Generate a 12-byte random nonce per encryption and pass it in ParametersWithIV/AeadParameters","Reject empty IVs at the call site before initializing the cipher","Never reuse a nonce with the same key; derive/store the nonce alongside the ciphertext"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}