# Is a random string good for an AES-256 instance

I have a randomly generated string of about 256 characters long. This string is hashed to for a key and initialization vector for a program running on the .NET framework 4.8. Is this method secure from a professional point of view?

• What is the size of the key, how it is generated? Not exactly a clear question and AES-256 has 256 bits of key not 256 characters. Apr 5, 2021 at 22:12
• The key size will become 256bit by hashing the random string into SHA256 byte array and MD5 for The initialization vector. All I Need To Know Is It Safe To Say That The string used to generate the keys will be hard to crack Apr 5, 2021 at 22:15
• Say that you have an alphabet of 64 characters (all upper and lowercase characters, digits and 2 special characters, not that many) Then each character contains 6 bits of entropy as 2^6 = 64. So your key is build from 256 * 6 = 1536 bits of entropy, which is more than enough. Then again, your key and IV are static, so if you want to encrypt multiple messages then you're better off prefixing a (usually 16 byte) random IV to the ciphertext so it can be used to initialize the cipher during decryption. Apr 5, 2021 at 22:21
• Please don't use MD5 ever. It's insecure and better attacks may be found. It would act as a red flag to any serious auditor of the protocol or code. Instead you might want to read up on KDF's such as HKDF and authenticated encryption. For transport mode security: use TLS. Apr 5, 2021 at 22:23
• Just for clarification a static IV could be used as a substitute for the MD5 hash instead, If not how would i go about generating an IV that is 128bit Apr 5, 2021 at 22:36

The Following Code Is Now Using The Password Derive Bytes Function, All Values Will Be Changed Accordingly

    string Password = "Example";
byte[] IV = {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};
byte[] Salt = Encoding.ASCII.getBytes("Salt Example");