0

I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them.

My question is if it is necessary to generate a random IV for encrypt/decrypt or it is already secure enough with a random AES key and fixed IV.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
Adri
  • 1
  • 1
  • 1

2 Answers2

2

You can use a null IV for all files ONLY if each file will be encrypted with a unique key. If you want to reuse the key, it's safer use a random IV for each file.

The issue is reusing the IV with the same key, when you do that, you reveal which files have the same first bytes. When you use a different key for each file, you don't have this problem.

R. C. W.
  • 21
  • 1
-1

No, you can't use a fixed IV, the IV needs to be unpredicatable. There are two good answers why this is the case here.

Swashbuckler
  • 2,126
  • 11
  • 8