I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too).
As you are well aware, CBC needs an IV in order to encrypt the first block since there are no previous blocks to inherit from.
I have done some research on IVs, and from what I can find:
- The IV should be random
- The IV should change from message to message
Currently, for ease of testing/debugging purposes, I'm using a fixed IV.
However, now that I have most of the bugs worked out in my program, I'm looking to improve the security by removing that fixed IV.
What I'd like to know is: Is it secure use a second key for the IV?
For example, my program currently prompts the user for a key of the appropriate length for the encryption process.
What If I prompted the user for either:
A) 2 keys (of the same length; one for IV and the other for the actual encryption)
B) 1 key twice as long (splitting it into two parts; the first for the IV & the second for the actual key)?
Would that be secure?