I'm looking to do file encryption for small amounts of text (8-100 characters for each item being encrypted). Here's what I have:
- A secret passphrase and a salt.
- I Use Rijndael to generate a key and iv when encrypting text.
- I use the key+iv to encrypt the text.
- I store the iv+encrypted text as the cipher.
- I HMAC the result.
Now my question is regarding the passphrase. It's a requirement for PCI DSS to rotate the passphrase at least annually. I was wondering if it would be insecure to have the year part of the passphrase. So, if my "core" passphrase is "Orange Ballons", the passphrase I'd use is "Orange Balloons2013", "Orange Balloons2015", etc. based on a year relevant to the business for that data item.
Is this a potential security hole, or is it okay to do this? My inclination is not to do it, but it will make key management a lot simpler in my particular use case.