title: Is it safe to encrypt a string using same string as key?
body: <p>Are there any security downsides in encrypting a given key with itself using AES in CBC mode, and using an IV (of course)?</p>
  
  <p>The principles are respected: the key is secret, and the IV is public (as this does not affect security of encryption).</p>
  
  <p>However, a potential attacker <strong>will know</strong> (as he can access the source code), that the string is encrypted using itself as the key.</p>
  
  <p>My judgment does not see any problems, but I'm trying to make sure.</p>
  
  <p>Thank you.</p>
  
  <p>EDIT - details of the task, I hope I'll be able to pass them across clearly, it's not yet very clear for myself:</p>
  
  <ol>
  <li><p>My system uses encryption to store certain values in MySQL tables. Encryption is performed on the PHP code (not the MySQL built-in AES). Obviously, I need a secret key, which needs to be setup by the system admin, just ONCE, at system setup. This is critical, because changing the key after any encrypted data has been saved as such, will make that data un-decryptable.</p></li>
  <li><p>Admin can setup secret key by simply editing a PHP script file via FTP (or whatever). But that's not what I want.</p></li>
  <li><p>What I want is having a install script, during which the admin choses the secret key, which gets encrypted with itself and stored into a table. Granted, a valid point that has been made below, is that you'd need the key to decrypt the key... I didn't get as far in my reasoning, I was at the stage of investigating if encrypting a key with itself as key is still a secure thing.</p></li>
  </ol>
  
  <p>If you have any ideas regarding the above, it'll be much appreciated.</p>
  
  <p>Thanks.</p>