Keeping IV secret for AES CFB mode I'm developing a security/encryption software and I'm using AES CFB (block size: 16 and key size: 32 bytes).

I want to know, if I also keep IV (32 bytes) secret like the key itself (32 bytes), would it add to security or not?

Encryption key and IV will not be specified by user, it will be generated and then encrypted with RSA and stored in safe storage. So I'm thinking to generate randomly key and IV. So if I also keep IV and key (both generated) in secure place would it make my crypto stronger or it's preferred to make IV constant in my application code?
Actually, for CFB mode, the IV is the same size as the block size, 16 bytes.

As for your question "does keeping the IV secret help security", the answer is "not really".

CFB mode processes the message in blocks, and for each block of plaintext, combines that with the previous block of ciphertext to generate the next block of ciphertext.  What the IV is used for is for the initial block of plaintext; there is obviously no previous ciphertext block, and so you use the IV instead.

What this means that if you keep the IV secret, it doesn't really hinder any particular attack in any way.  One way to see that is to assume the contrary; let us assume that, if we expose the IV to the attacker, that he can exploit some weakness.  If we assume that, then the attacker can use that weakness to attack a CFB mode encrypted text without the IV; what he does is take the ciphertext (without the IV), and treat the initial ciphertext block as the IV, and the rest of the ciphertext as the "real" ciphertext; the plaintext this corresponds to is the normal plaintext with the initial block omitted.

Because of this, if exposing the IV with CFB mode lead to a weakness, CFB mode in general is weak.  Now, written this way, this might not sound very comforting; however athat statement is logically equivalent to "if CFB mode is strong, then CFB mode with the IV mode exposed is strong", which is really what we want to show.

In addition, you ask whether:


  It's preferred to make IV constant in my application code


It is absolutely a bad idea to have a constant IV with CFB mode; he's why: the initial ciphertext block is:

$C_0 = P_0 \oplus AES( IV )$

What this means is that if an attacker sees two encrypted messages with the same IV and key, then he knows the above and also knows:

$C'_0 = P'_0 \oplus AES( IV )$

Even though is might not know what the IV is, he can combine the two equations to form:

$C_0 \oplus C'_0 = P_0 \oplus P'_0$

In other words, by examining the bit differences between the two initial ciphertext blocks, he can deduce the bit differences between the two initial plaintext blocks; that is far more information than we want an attacker to know.

Instead, you are far better off either using random IVs or possibly using a counter (if randomness is a problem for you).