Best practices (if any) to add metadata to encrypted files I am encrypting files using AES/CBC/PKCSPadding, with 256 bits long keys. So far the first 16 bytes of each encrypted file are the IV.

I would like to store some more information regarding the algorithm used, key length, mode and padding at least.

This will be useful I think for two reasons:

a) I can scan the filesystem looking for my files and checking they are all encrypted (encryption is a new feature, so there are already a bunch of unencrypted files out there). This way I can create a background task that progressively encrypts all old files

b) Say someone breaks AES or there's a problem with CBC or something in 10 years or whatever. I could just upgrade the parameters of the encryption function and again scan the file system and upgrade the encryption of my files.

I was thinking for this something like:

byte[] header = "AES|256|CBC|PKCS5Padding|".getBytes(UTF_8);
byte[] iv = ...; // the result of cipher.getIV() after initializing the Cipher;


And then writing both the header + IV to the beginning of the file.

So my question is: Does adding such metadata to encrypted files create any security concerns for such files? Is this something that people normally do? If so, is the way I'm trying to do it (adding a fixed number of bytes) will be enough to accomplish this task?
This is pretty common. The method of encryption is public information, so it is safe to leave in the clear.

In your post you made no mention of authentication. This is something you absolutely must use, otherwise you have no way of knowing if your data has been modified and leaves you open to many attacks.

Consider using HMAC with SHA-256, or a block cipher mode with built-in authentication (e.g. GCM). Everything needs to be authenticated (any metadata, header, IV, ciphertext, etc).