title: Good AES Initialization Vector practice
body: <p>per my question <a href="https://stackoverflow.com/questions/8041153/aes-encryption-missing-an-important-piece">Aes Encryption... missing an important piece</a>, I have now learned that my assumption for creating a reversible encryption on a string was a bit off.  I now have </p>
  
  <pre><code>    public static byte[] EncryptString(string toEncrypt, byte[] encryptionKey)
      {
          var toEncryptBytes = Encoding.UTF8.GetBytes(toEncrypt);
          using (var provider = new AesCryptoServiceProvider())
          {
              provider.Key = encryptionKey;
              provider.Mode = CipherMode.CBC;
              provider.Padding = PaddingMode.PKCS7;
              using (var encryptor = provider.CreateEncryptor(provider.Key, provider.IV))
              {
                  using (var ms = new MemoryStream())
                  {
                      using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
                      {
                          cs.Write(toEncryptBytes, 0, toEncryptBytes.Length);
                          cs.FlushFinalBlock();
                      }
                      return ms.ToArray();
                  }
              }
          }
      }
  </code></pre>
  
  <p>and this produces consistent results; however, I will not be able to decrypt without knowing/ setting the initialization vector.  I really do not want to pass three values into this method (on for the IV), which leaves me with hardcoding the IV or deriving it from the key.  I'd like to know if this is a good practice, or if it will render the encrypted value vulnerable to attack somehow... or am I really overthinking this and should just hardcode the IV?</p>
  
  <p><strong>UPDATE</strong>
  Per Iridium's suggestion, I tried something like this instead:</p>
  
  <pre><code>    public static byte[] EncryptString(string toEncrypt, byte[] encryptionKey)
      {
          if (string.IsNullOrEmpty(toEncrypt)) throw new ArgumentException("toEncrypt");
          if (encryptionKey == null || encryptionKey.Length == 0) throw new ArgumentException("encryptionKey");
          var toEncryptBytes = Encoding.UTF8.GetBytes(toEncrypt);
          using (var provider = new AesCryptoServiceProvider())
          {
              provider.Key = encryptionKey;
              provider.Mode = CipherMode.CBC;
              provider.Padding = PaddingMode.PKCS7;
              using (var encryptor = provider.CreateEncryptor(provider.Key, provider.IV))
              {
                  using (var ms = new MemoryStream())
                  {
                      ms.Write(provider.IV, 0, 16);
                      using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
                      {
                          cs.Write(toEncryptBytes, 0, toEncryptBytes.Length);
                          cs.FlushFinalBlock();
                      }
                      return ms.ToArray();
                  }
              }
          }
      }
  
      public static string DecryptString(byte[] encryptedString, byte[] encryptionKey)
      {
          using (var provider = new AesCryptoServiceProvider())
          {
              provider.Key = encryptionKey;
              provider.Mode = CipherMode.CBC;
              provider.Padding = PaddingMode.PKCS7;
              using (var ms = new MemoryStream(encryptedString))
              {
                  byte[] buffer;
                  ms.Read(buffer, 0, 16);
                  provider.IV = buffer;
                  using (var decryptor = provider.CreateDecryptor(provider.Key, provider.IV))
                  {
                      using (var cs = new CryptoStream(ms, decryptor, CryptoStreamMode.Read))
                      {
                          byte[] decrypted = new byte[encryptedString.Length];
                          var byteCount = cs.Read(decrypted, 0, encryptedString.Length);
                          return Encoding.UTF8.GetString(decrypted, 0, byteCount);
                      }
                  }
              }
          }
      }
  </code></pre>
  
  <p>however, this shows something odd in my unit test:</p>
  
  <pre><code>    [TestMethod]
      public void EncryptionClosedLoopTest()
      {
          var roundtrip = "This is the data I am encrypting.  There are many like it but this is my encryption.";
          var encrypted = Encryption.EncryptString(roundtrip, encryptionKey);
          var decrypted = Encryption.DecryptString(encrypted, encryptionKey);
          Assert.IsTrue(roundtrip == decrypted);
      }
  </code></pre>
  
  <p>my decrypted text shows up as "92ʪ�F"�,hpv0�� I am encrypting.  There are many like it but this is my encryption." which <em>seems</em> almost right but of course completely wrong.  It looks like I'm close though.  Am I missing an offset on the memory stream?</p>