The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored anywhere but in the brain of the owner of the files) however I'm worried about the management of the salt and the IV.
From several sources I've seen that the salt must be unique and never reused (which imples using a cryptographically secure pseudorandom number generator) but it can be safely appended in clear text to the encrypted data. Is this right?
For the IV I have seen two different approaches:
- Similar to the salt, generate in randomly and store in clear text.
- Derive it from the password and salt, the same way it is done with the key used to encrypt each block via the AES algorithm.
Which is the preferred / safest way?