title: How can i save a encryption key securely on a system (openssl,c)?
body: <p>Hi i am using openssl evp api to encrypt/decrypt a file using AES256CBC.</p>
  
  <p>The file is encrypted with <strong>key 'k'</strong> and <strong>iv 'v'</strong> (which were generated using <code>EVP_BytesToKey()</code>function where i supply a random bytes of data as salt which i get from <code>RAND_bytes()</code> and a password supplied by user and then using these two i initialize the encrypt context and decrypt context.</p>
  
  <p>The function for initialization is:</p>
  
  <pre><code>int aes_init(unsigned char* pwd, unsigned int pwd_len,EVP_CIPHER_CTX *e_ctx, EVP_CIPHER_CTX *d_ctx)             /* return 0:SUCCESS 1: ERROR */
     {
      int i, rounds =5;                                       /* rounds */
      unsigned char key[32], iv[32], salt[8];
  
      if(!(RAND_bytes(salt,8))) //Writes cryptographically secure random bytes in salt[]
      {   
              perror("\n ERROR,SALT::");
              return 1;
      }   
  
      i = EVP_BytesToKey(EVP_aes_256_cbc(),EVP_sha1(),salt,pwd,pwd_len,rounds,key,iv);
     }
  </code></pre>
  
  <p><strong>What i intend to implement is this scenario:</strong></p>
  
  <p>User encrypts the file A with key k and IV v. program exits normally
  Then if now User now wants to decrypt the encrypted file A he/she will need the same cipher context i.e. same key k, same IV.</p>
  
  <p><strong>So my problem is how can i securely save the key and iv ( the same used for encryption) so that i can use it to decrypt the file at a later time.</strong></p>
  
  <p><strong>NOTE:</strong> <em>i have seen some commercial encryption products creates a sort of keystore for this, any idea how it is done.</em></p>
  
  <p>Are there any set of guidelines that are followed for this ?</p>
  
  <p>Any suggestion would be highly appreciated..</p>
  
  <p>Many thanks</p>