Should I store my encrypted password's salt and initialization vector as clear text?

Question

I'm encrypting some file with AES-256-CBC, and I'm planning to store the cipher text in a json file, with something like:

{
    "data": "0123456789ABCDEF...",
    "salt": "00123ABCAABBCCDD...",
    "iv": "000111ABCCBBCCDDFD..."
}

Then, when I read the file again, I deserialized the data, and then I use the salt to rederive the key, and the iv to decrypt the file. Is this way of storage recommended/secure?

Please note that the data is not huge. It's barely some text, which is why I don't care if serialization increased the size of the data.

Why am I not just concatenating them in byte form? Because I want to have backward compatibility in the future by adding more meta data in the json file, like version, etc.

Why am I not writing the data in json as bytes? Because I can't garantee that the cipher text will not have ascii characters that may break my json file, like ", for example.

Answer 1

Assuming you don't care about efficiency, then the only real issue is that you are using CBC mode which is unauthenticated. There is no cryptographic issue with storing values which are not meant to be kept secret in any arbitrary encoding, whether hex, or base64, or uuencode. In fact, the new LUKS2 format for disk encryption does exactly this, storing encryption-related data in JSON.

You should probably use base64 though, because hex is unnecessarily inefficient.