I'm writing a program that can encrypt a file using AES cfb128 (using Openssl and C++).
The scenario of the program is this:
- Person A visits computer, encrypts a file they make, takes away a key (on USB stick?)
- Person B visits computer and is unable to decrypt encrypted file
- Person A comes back and decrypts the file using their key
My question is I have an encryption key and initialization vector that I must set for the AES encryption. I plan on randomly generating numbers for one and using a hardware ID for the other. Also the person could choose to encrypt multiple files.
So how would I do this?
Can I make the encryption key the hardwareID and the init vector a sequence of random bits?
If the same hardwareID and init vector are used to encrypt multiple files per machine, is this unsecure given that an attacker will not have the init vector but may have the encryption key? Should the encryption key be the random bit instead and the hardware key be the init vector?
Or should both the encryption key and init vector be random and unknown to the attacker? And if so, is it secure to encrypt multiple files using the same 2 unknown keys?