Encrypted URL and salt data

Question

When transmitting encrypted data in a URL or possibly storing encrypted data in a cookie, is it possible and / or nassassary and / or is it also possible to transmit Symetric Encryption IV (Salt) to the same URL? Is the idea of ​​using Salt even valid in a stateless environment, such as the Internet?

(I understand how salt works in a database based on a list of names or accounts, etc., but we cannot save salt, given that we are transferring data in a stateless state.

Assuming a server-side password that is used to encrypt data and then decrypt data, how can salt be used? I think a separate IV can be passed in the query string, but publicly exposes the ok salt?

Or you can generate a key and IV from the password hash. Assuming that IV and Key come from disjoint hash areas, is this normal? (I understand that the salt / key will always be the same for the given password.)

EDIT: AES is commonly used.

Answer 1

It is recommended that you generate random IVs for each encryption procedure, and they can be safely transmitted using encrypted text.

Edit:

I should probably ask what information you store and why you use salt with AES encryption, since salts are usually used for hashing, and not for symmetric encryption. If the salt is publicly available, it defeats the purpose of its use.

What you really need to do is ensure the strength of your key, because if the attacker has salt, IV and ciphertext, a brute force attack can easily be performed on weaker keys.

Answer 2

You should not generate an initialization vector from a secret key. The initialization vector must be unpredictable for this message; if you generated it from a key (or the password used to generate the key), IV will always be the same as its target wins.

However, IV should not be secret. Very often send it with encrypted text, unprotected. Including IV in the URL is much simpler than trying to track the IV for a given link in some state on the server side.

---

Salt and IV have different applications, but they act in a similar way.

Cryptographic "salt" is used in password-based key derivation algorithms; storing a hashed password for authentication is a special case of this function. The salt causes the same password to give different hashes and prevents “dictionary attacks” when the hacker pre-calculates the hash values ​​for shared passwords and creates a “reverse lookup” index so that they can quickly find the password for this hash. Like IV, the salt used is not a secret.

The initialization vector is used with block ciphers like DES and AES in feedback mode, for example, CBC. Each block is combined with the next block when it is encrypted. For example, in CBC, the previous block ciphertext has XOR-ed with the plaintext of the current block before encryption. IV is randomly generated to serve as a fictitious starting block for the boot process.

Since a different IV (or at least the selected one) IV is selected for each message, when the same message is encrypted with the same key, the resulting encrypted text is different. In this sense, IV is very similar to salt. A cryptographic random generator is usually the simplest and most reliable source of salt or IV, so they have similarities.

---

Cryptography is very easy to mess up. If you are unsure of your actions, you must consider the value of the information you protect and, accordingly, the budget, in order to receive the training or advice you need.