I am encrypting a DEK (data encryption key) with a KEK (key encryption key). The KEK is generated from a password using scrypt with default parameters and a 32 byte randomly generated salt. The encryption algorithm is AES-GCM.
What are the implications for the IV in this case? Let's assume that the IV is initialized to 0 (96 bits of 0s). If I re-use an IV with a key then this is bad news. Since the key is generated from the password it will always be the same. But I do generate a random 32 byte salt each time I re-encrypt the file which should provide a different key each time. I would assume that a 32 byte salt would change the KEK significantly so that the zero initialized IV would not pose an issue for GCM. Is this a valid assumption?