title: Secret vs. Non-secret Initialization Vector
body: <p>Today I was doing some leisurely reading and stumbled upon Section 5.8 (on page 45) of <a href="http://csrc.nist.gov/publications/nistpubs/800-56A/SP800-56A_Revision1_Mar08-2007.pdf" rel="nofollow noreferrer"><em>Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography (Revised)</em> (NIST Special Publication 800-56A)</a>.  I was very confused by this:</p>
  
  <blockquote>
    <p>An Approved key derivation function
    (KDF) shall be used to derive secret
    keying material from a shared secret.
    The output from a KDF shall only be
    used for secret keying material, such
    as a symmetric key used for data
    encryption or message integrity, a
    secret initialization vector, or a
    master key that will be used to
    generate other keys (possibly using a
    different process). Nonsecret keying
    material (such as a non-secret
    initialization vector) shall not be
    generated using the shared secret.</p>
  </blockquote>
  
  <p>Now I'm no Alan Turing, but I thought that initialization vectors need not be kept secret.  Under what circumstances would one want a "secret initialization vector?"
  <a href="https://stackoverflow.com/questions/2791745/characteristics-of-an-initialization-vector">Thomas Pornin</a> says that IVs are public and he seems well-versed in cryptography.  Likewise with <a href="https://stackoverflow.com/questions/1785555/how-should-i-generate-an-initialization-vector">caf</a>.</p>