Home/ Questions/Q 162181
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T11:20:43+00:00

When passing symetrically encrypted data in a URL or possibly storing encrypted data in

  • 0

When passing symetrically encrypted data in a URL or possibly storing encrypted data in a cookie, is it resonable and/or nessassary and/or possible to also pass the Symetric Encryption IV (Salt) in the same URL? Is the idea of using Salt even valid in a stateless environment such as the web?

(I understand how salt works in a database given a list of names or accounts etc. but we can’t save the salt given that we are passing data in a stateless environment.

Assuming a server side password that is used to encrypt data and then decrypt data, how can Salt be used? I guess a separate IV could be passed in the query string but is publicly exposing the salt ok?

Or can one generate a key and IV from the hash of a ‘password’. Assuming the IV and Key come from non-overlapping areas of the hash, is this ok? (I realize that the salt / key will always be the same for a given password.)

EDIT: Typically using AES.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. It is encouraged to generate random IVs for each encryption routine, and they can be passed along safely with the cipher text.

    Edit:

    I should probably ask what type of information you’re storing and why you’re using a salt with AES encryption, since salts are typically used for hashing, not symmetric encryption. If the salt is publicly available, it defeats the purpose of having it.

    What you really need to do is ensure the strength of your key, because if an attacker has the salt, IV, and cipher text, a brute-force attack can easily be done on weaker keys.

    • 0