(Note: originally posted in SO - advised to post on SSE)
With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or more of these values (specifically in a C# .NET web application):
- Initialisation vector (IV)
- Pass phrase
Is it common practice (or in fact necessary) to change any of these values over the lifetime of an application? (For example, if one or more are compromised, or just as part of a general policy.)
If so, what will be the impact upon existing data in a database which was encrypted using the original (prior) values? By changing these values, one would think that the decryption of existing data would no longer 'work' (or return false information?).
(I imagine the scope of this question might include the way in which such values are stored - e.g. using third-party or otherwise secure storage mechanisms - so initially let us say the aforementioned values are currently stored in plain text in a class named RijndaelCryptography, and go on from there.)
To illustrate my question, please see the following link: How To: Encrypt and Decrypt Data Using a Symmetric (Rijndael) Key (C#/VB.NET)
Is that particular example in any way good practice (fixing the pass/salt/IV at code level)?
- Removed "AES" from question.
- I read that Microsoft advise using AES instead of Rijndael:
"The Rijndael class is the predecessor of the Aes algorithm. You should use the Aes algorithm instead of Rijndael. For more information, see the entry The Differences Between Rijndael and AES in the .NET Security blog." (Link - see half-way down that page)