Best way to store Encryption Key and IV(Initialization Vector) with AES

Question

As a result of the Veracode security scan, the Encryption Key and IV were found to be hard-coded in the code. For encryption, we are also using the old TripleDES algorithm.

In this case, we must remove the hard-coded key and IV and also update to the AES algorithm. This is a utility class that will be used throughout the application (in Web application, Windows application and WCF services)

Hard code key and IV in Encryption class

It is a legacy application that has recently been moved to AzureDevops. The process of removing hard-coded keys and implementing a new encryption standard presents some challenges.

1.The best way to store the encryption key and IV securely is local/store in files.

2.We don't have option to store in AzureKeyValut and use Environment Variable.

3.Also Client not accepting to store Key & IV store in Web.Config and Database.

4. Encryption & Decryption mostly used for login and also encrypting some data at runtime.
5. Mostly use Powershell scripts for automation tasks.

I have chosen AES CBC Mode symmetric algorithm for server side encryption. But Not sure how to deal encryption key storage.

What are the best approaches/secure ways to store the Key & IV locally or any other options available? 

Please assist and share helpful thoughts.

 

Thanks in advance.

Answer 1

for old asp.net, IIS encryption services is probably best:

https://learn.microsoft.com/en-us/previous-versions/aspnet/zhhddkxy(v=vs.100)