I've got a friend who stores some important data locally in a database. Before storing, he however first encrypts it with AES GCM with a certain key. He then encrypts the IV with another key, and then appends it to the encrypted data.

Looking at this, I started wondering, is there an advantage to this? Also, is there a better way to implement security especially when you use 2 passwords anyway?

P.S. My friend is paranoid.

  • 2
    your friend simply misunderstands how aes works. it's understandable to want to be safe, ever safer than the next guy, but such obscurity only increases the chance of data loss while providing little to no actual security.
    – dandavis
    Oct 2, 2018 at 15:47

1 Answer 1


NIST recommends using a random IV for AES-GCM. As GCM is a variant of CTR mode, you should never reuse the same IV with the same key, or an attacker can recreate parts of the plaintext if he knows something about its structure.

Encrypting the IV does not add much, as any security protocol must keep data secret when only the key is secret. If disclosing anything but the key compromises the security, then the process is not secure. AES-GCM is proven to be secure, so encrypting the IV is redundant.

  • 2
    "proven to be secure" is a bit of an overstatement. It's strongly believed to be secure (as long as the nonce isn't reused of course). Also, if your threat model involves an attacker having access to an encryption oracle, NIST requires a maximum of only 2^32 encryptions per key. This is why section 8.2.1 describes a deterministic IV construction with a 32 bit fixed field and a 64 bit counter without the 2^32 invocation limit. Oct 1, 2018 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .