I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. That means for every account, a unique salt is also created.
What I don't get is how do you store an AES Key and IV? Should there be a unique AES Key and IV for every account too? Or should there be 1 app wide AES Key and another app wide IV?
I've read this post but it only answers where I should store them.