CVE-2021-26322

The platform stores a private key without proper random protection, which could allow an attacker to recover the key by comparing encrypted messages. This weakens the entire security of the system.

The vulnerability results from reuse of initialization vectors (IVs) when encrypting the platform's private key, enabling two-time pad attacks where an attacker with access to multiple ciphertexts can recover the plaintext key. The issue affects at-rest encryption of persistent cryptographic material without cryptographically random IV generation per encryption operation.