Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any security risks in using a static IV if I generate a new random KEY for each set of data to encrypt?

If I understand correctly what the purpose of the IV is in Cipher-block chaining mode of operation, there is no issue in doing things like this. Am I missing something?

If it helps, I am talking about something like this:

aes_key=$(openssl rand -hex 32)
openssl enc -aes-256-cbc -nosalt -base64 -K ${aes_key}  -iv "b63e541bc9ece19a1339df4f8720dcc3" -in some_file_to_encrypt -out encrypted_file
share|improve this question
up vote 4 down vote accepted

If you are really using a new random key for each message, you can use a fixed initialization vector, yes.

But usually you want to reuse a key for several messages - for example, as you somehow have to transfer your key to the receiver of the message, and then using a random initialization vector for each message is important to avoid showing similarities between the messages in the ciphertexts.

In your example, what else are you doing with the key? How does the receiver of the message gets the key?

share|improve this answer
the encrypted KEY - using a Public-key cryptography algorithm (RSA) - is passed together with the AES-encrypted data. – João Portela Dec 26 '11 at 13:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.