I am trying to get my head around how AES works and in particular I have queries around the key generation and 'passphrases'.
My understanding is that AES has a 128 bit block size but the key length changes depending on which variation you use, e.g AES256 uses a 256bit key.
- If the encryption is reliant on the key, should you be using a cryptographically secure psuedorandom random number generator in order to generate a 256 bit key?
- Looking at this site it also allows you to set a passphrase when generating a key. What role does the passphrase have when generating the key?
- If you were required to rotate an AES key due to policy, would the encrypted data need to be decrypted using an old key before re-encrypting with the new key? I'd assume this would need to be built within the application login?