title: Is it insecure to pass initialization vector and salt along with ciphertext?
body: <p>I'm new to implementing encryption and am still learning basics, it seems.</p>
  
  <p>I have need for symmetric encryption capabilities in my open source codebase.  There are three components to this system:</p>
  
  <ul>
  <li>A server that stores some user data, and information about whether or not it is encrypted, and how</li>
  <li>A C# client that lets a user encrypt their data with a simple password when sending to the server, and decrypt with the same password when receiving</li>
  <li>A JavaScript client that does the same and therefore must be compatible with the C# client's encryption method</li>
  </ul>
  
  <p>Looking at various JavaScript libraries, I came across SJCL, which has a lovely demo page here: <a href="http://bitwiseshiftleft.github.com/sjcl/demo/" rel="noreferrer">http://bitwiseshiftleft.github.com/sjcl/demo/</a></p>
  
  <p>From this, it seems that what a client needs to know (besides the password used) in order to decrypt the ciphertext is:</p>
  
  <ul>
  <li>The initialization vector</li>
  <li>Any salt used on the password</li>
  <li>The key size</li>
  <li>Authentication strength (I'm not totally sure what this is)</li>
  </ul>
  
  <p>Is it relatively safe to keep all of this data with the ciphertext?  Keep in mind that this is an open source codebase, and there is no way I can reasonably hide these variables unless I ask the user to remember them (yeah, right).</p>
  
  <p>Any advice appreciated.</p>