Skip to content

Use a random IV #12

Description

@capybit

Thank you for your library—it has definitely helped me see the light at the end of the tunnel.

After some research, I found that the initialization vector (IV) should always be randomly generated for each encryption operation to ensure robust security. Using a static IV can lead to vulnerabilities, as it compromises the cryptographic principle of uniqueness for each encryption. https://stackered.com/blog/iv-mishandling/

A potential solution could be to randomly generate the IV for each encryption and prepend it to the ciphertext. A custom database function could then extract the IV from the database column and use it to decrypt the remaining ciphertext.

Is there a chance that such an adjustment could be implemented in the near future? Alternatively, would it be possible to use the pgp_sym_decrypt database function along with a compatible C# implementation to handle encryption and decryption?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions