I want to improve the encryption flow used by my application. Today I use the AES cipher while its key and its IvBuffer are hardcoded in the code. I know it is not secured and I want to improve this. I want to create a new AES cipher while its key will be stored in the database. The key will be encrypted by the old AES cipher.
Application will use the new AES cipher:
- Decrypt the key for the new cipher using the old cipher.
- Encrypt / decrypt information using the new cipher using the decrypted key.
The flow will allow easier key rotation in the future (I can elaborate it but it is not related to my question).
How the encryption process is secured?
What to do with IvBuffer for the new AES cipher? To store it in the database or to put hardcoded in the code?
I understand from the answer below that the additional hardcoded key does not improve my security. I need store the encryption key in the database (option 7 listed here Where to store a key for encryption?). Unfortunately I can not use external devices for the key storage and therefore I need to use database.
Question if the security of the option when key is stored in the plain text in the database is better that the option when additional hard coded key is used for the same key stored in the database?