[openssl-users] AES-256 Do I need random IV?

[Jakob Bohm]

On 27/04/2017 14:00, Yaşar Arabacı wrote:
> Hi,
>
> For AES-256 encryption, should IV be random? I am already using a
> random salt, so I was wondering if IV should be random too.
>
> Thanks in advance
>
AES itself takes neither an IV nor a salt.

AES in CBC mode takes a 128 bit IV for the CBC mode, it is best if
attackers cannot predict the IV before providing some data that they
"trick" you into encrypting.

AES in CBC mode should also not be used more than once with the same
combination of IV and key.

Various ways to choose a key (256 bit for AES-256) from a
human-memorable password involve the use of a salt to get different
keys for different runs with the same password, and to make the number
of possible keys much larger than the number of possible human-memorable
passwords.  Using a random or otherwise unpredictable key that isn't
from a password at all is usually safer than using a key based on a
password.

Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded