I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along value impact the strength of security?
Each user will have their own symmetric key that does get re-generated periodically (maybe only hundreds or thousands of messages for each key, each message maybe hundreds or rarely thousands of bytes). If I randomly generate 16 or 20 bits, hash that using SHA-256 and use the first 128 bits as an IV, how does that impact the overall security? Is it now in effect 16 or 20 bits?
Would adding additional information – that both the server and the user know – into the hash help? Are there modes that would be better than others for this scenario? I've read about Synthetic Initialization Vector (SIV) mode being resistant even if there's no IV, however from what I understand it generates a tag of the block size which defeats my purpose. Can’t I send the tag and still encrypt, while only losing authentication?