Here is a hypothetical application of AES-CTR encryption.
- Step 1: Generate random key and IV for new object;
- Step 2: Use said key and iv to encrypt some data, which is then stored on a content server;
- Step 3: Encrypt key and IV using some secret master key, and store the wrapped keys in a database table.
Important: For each new object that we want to encrypt, a new key and IV are randomly generated.
- Step 1: Retrieve encrypted key and IV relevant to object that we want to decrypt
- Step 2: Decrypt key and IV using master key
- Step 3: Use decrypted key and IV to decrypt object
I would like to know if this is an acceptable way to proceed with AES-CTR (assuming the master key is handled securely, and we are also hashing content to ensure integrity)?
If not, could you please suggest a more secure way to manage key and iv for a given object?