title: Java encryption ivSpec random or not?
body: <p>I am trying to send an encrypted text with each HttpResponse and when I get the next HttpRequest with the encrypted text, I decrypt it and do some stuff :) with it. </p>
  
  <p>I am curious about the best practices surrounding the storage/retrievel of the keys and ivSpec's (or nonce's) in general, but specifically looking at the code posted by @sherif based on @VoidPointer 's suggestions in <a href="https://stackoverflow.com/questions/1205135/how-to-encrypt-string-in-java">How to encrypt String in Java</a>, </p>
  
  <p>a) Do we have to initialize ivSpec with random bytes for each string that I want to encrypt?</p>
  
  <p>b) If so, do we store the generated ivSpec in some db and look it up when I need to decrypt using that? </p>
  
  <p>c) If so, how do we look it up? When an encrypted string needs to be decrypted how do we pick the correct ivSpec from db? </p>
  
  <p>d) One suggestion is to <a href="https://stackoverflow.com/questions/7275944/how-to-make-ivparameterspec-random-but-still-decrypt">send ivParameter along with the encrypted string</a>! itself (which is probably what is happening with <a href="https://stackoverflow.com/questions/1205135/how-to-encrypt-string-in-java">@sherif 's implementation</a>!). If we chose to do so, how can I modify the class provided by @sherif to decrypt and separate the iv parameter and encrypted string instead of providing the iv parameter while initializing decrypt cipher?</p>