Zennoxa Shield
Rules / C/C++
SHIELD-CPP-014

Insecure ECB cipher mode

highC/C++CWE-327CVSS 7.4

What it detects

ECB mode leaks plaintext structure and is not semantically secure.

How to fix

Use an authenticated mode such as GCM with a unique nonce per message.

Vulnerable — Shield flags thiscipher.c
#include <openssl/evp.h>

int start_encrypt(EVP_CIPHER_CTX *ctx, const unsigned char *key) {
    /* ECB leaks plaintext structure across blocks */
    return EVP_EncryptInit_ex(ctx, EVP_aes_128_ecb(), NULL, key, NULL);
}
Fixed — scans cleancipher.c
#include <openssl/evp.h>

int start_encrypt(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                  const unsigned char *nonce) {
    /* AES-GCM: authenticated, unique nonce per message */
    return EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, key, nonce);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-014: Insecure ECB cipher mode — Zennoxa Shield