I’m making a project in Java and Python that includes sending an encrypted string from one to the other. I can get the languages to understand each other and fully de-crypt / encrypt strings. However I was talking to somebody and was told that I am not being totally secure. I am using AES encryption for the project. Part of the problem is that I am distributing the software and need to come up with an effective way and secure way of making sure both the server side know the IV and ‘Secret Key’. Right now the same string will always encrypt to be the same result. If I could change those two factors they would be different, so 2 users with the same password won’t have the same encrypted password. Please do keep in mind that the server only needs to manage one account.
I appreciate your responses, and thank you very much ahead of time!
Typically, you’d generate the IV randomly, and send it along with the encrypted message. The IV doesn’t need to be secret–it just needs to be different for every message you send.
There are a wide variety of concerns to worry about when implementing crypto. Your block cipher mode matters, for instance–if you’re using an IV you probably aren’t using ECB, but that leaves quite a few other options open. Padding attacks and other subtle things are also a concern.
Generally, you don’t want to implement crypto yourself if you can possibly avoid it. It’s much too easy to get wrong, and usually quite important to get right. You may want to ask for more help on the Security StackExchange.