From my understanding the IV is used as a previous block for the first block only. But since each block is used by the following this adds significant security is a IV is provided and not based on the password.
Thus I implemented a login system when the user provides both, distinct with a minimum of 8 characters using any characters they care as long they use at least 3 types (upper, lower, numeric, special, non ASCII).
But now someone told me that by defining the IV I weaken the encryption as that would make the password sort-of useless.
I did not exactly understand his explanation.
My code looks like this:
$hash = openssl_encrypt($username, 'aes-256-cbc', $password, false, md5($iv, true));
- Yes I am encrypting the username
- Both the password and IV are user defined
- Yes I am asking them for two passwords
- I'm wrapping the IV in RAW md5 to ensure I get a standard 16 chr length
Can someone clarify if the IV use in this manner is a good practice and is this idea is strong enough.