fix: use random nonce per call in AES-GCM onboarding signature (ISS-2528895)

[rzp-slash]

Summary

• Vulnerability: AES-GCM nonce reuse in generateOnboardingSignature (HackerOne #3754503 / ISS-2528895)
• Root cause: encrypt() used the first 12 bytes of the AES key as a fixed IV — identical for every encryption call with the same partner secret
• Impact: An attacker who captures just 2 onboarding_signature values from partner URLs (browser history, logs, Sentry) can XOR the ciphertexts to recover the keystream and forge valid signatures for arbitrary submerchant IDs — without ever knowing the partner's secret key

Fix

Replace the static IV with SecureRandom.nextBytes(iv) and prepend the nonce to the output so the Razorpay backend can extract it for decryption.

Before:

byte[] iv = new byte[12];
System.arraycopy(keyBytes, 0, iv, 0, 12); // static — same every call
// ...
return bytesToHex(encryptedData); // hex(ciphertext || tag)

After:

byte[] iv = new byte[12];
new SecureRandom().nextBytes(iv); // fresh random nonce per call
// ...
byte[] combined = new byte[iv.length + encryptedData.length];
System.arraycopy(iv, 0, combined, 0, iv.length);
System.arraycopy(encryptedData, 0, combined, iv.length, encryptedData.length);
return bytesToHex(combined); // hex(iv[12] || ciphertext || tag[16])

New output format: hex(iv[12 bytes] || ciphertext || tag[16 bytes])
The receiver reads the first 24 hex chars (12 raw bytes) as the IV before decrypting.

Companion PRs (same fix, same format across all partner SDKs)

• razorpay-php: fix: use random nonce per call in AES-GCM onboarding signature (ISS-2528895) razorpay-php#411
• razorpay-node: pending
• razorpay-ruby: pending

Test plan

• Verify generateOnboardingSignature produces a different hex string on every call with the same input
• Verify output length = 24 (iv) + 2×(plaintext_len) + 32 (tag) hex chars
• Verify Razorpay backend successfully decrypts the new format
• Confirm two signatures XORed no longer reveal plaintext (keystream is not reused)

🤖 Generated with Claude Code