Q. How do I handle initialization vectors (IV) and salts correctly?

A:

• Use a unique, random IV per encryption (but IVs need not be secret, just unpredictable).

• Use a salt when deriving keys from passwords (e.g. with PBKDF2).

• Store the IV (and salt) alongside the ciphertext (e.g. prefix it).

• Use authenticated encryption modes (e.g. AES-GCM) so you can verify integrity and detect tampering.