I am wondering how secure it is to encrypt and decrypt strings using OpenSSL using Salts and an Initialisation Vector. If the salt and initialisation vector are both going to be stored in a database along with the encrypted string, can't a possible attacker just take the encrypted string, salt and IV and decrypt the string? If this is possible how would it be made more secure so this isn't possible? The primary use case for this is to be able to encrypt & decrypt user data to display to the user.
closed as too broad by Steffen Ullrich, WhiteWinterWolf, Tobi Nary, Steve, Xander Aug 6 '17 at 21:35
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
I think you are mixing several things together here:
- OpenSSL is a library which has implementations for a variety of cryptographic algorithms, both for strong and for weak algorithms. Thus, the security first depends on which algorithm you use.
- You are trying to use symmetric encryption where the same key is needed for encryption and decryption. Of course, this key must be protected against an adversary. But how this is done is not part of the encryption algorithm and not part of OpenSSL either.
- For encryption you need a key, not a salt. Salt instead is used in the context of password hashing. Also the IV is not needed to decrypt the encrypted text so no need to store it explicitly.
Of course storing the decryption key together with the encrypted data makes no sense because if an attacker gets access to both it can simply decrypt the data.
But, how this secret key should be protected fully depends on your unknown use case, on the value of the data and on the assumed capabilities of the adversary.
Salts are for hashing passwords, not for encryption. To encrypt or decrypt using most encryption modes you need the Key and the IV.
I think you should provide more information on what you're trying to accomplish, if you're trying to store passwords I'd read through this answer.