1
$\begingroup$

I am using AES-GCM-256 to encrypt data in a database, and am using a single key that I salt with a unique random value for each user to encrypt their information. I am using the same IV for all of this.

Is this secure so long as I change the key each time?

$\endgroup$

1 Answer 1

4
$\begingroup$

Is this secure so long as I change the key each time?

Yes, using the same IV with different keys is perfectly safe.

However, if you encrypt some data for a user, and then the user updates his data, will you encrypt that new data with the same key? If so, well, you've just used the same (key, iv) pair for two separate sets of data

$\endgroup$
1
  • $\begingroup$ Thanks for pointing that out, I will make sure to change the key each time. $\endgroup$ Feb 8, 2023 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.