I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of the credentials for the internal app.
I picked AES as the encryption algorithm, but the problem is that the password-based scheme doesn't produce a "secret" IV. So, the IV must at least be known to an attacker (stored alongside the encrypted data). A hash value used for password verification could work, or I could just generate a pseudorandom byte array and drop it in the DB as a new column. I was further considering, for simplicity, using a constant IV.
The question is, what adverse effect will any of these have on the security of the encryption? Does AES depend, as many block ciphers do, on an unpredictable IV? Does it matter if the IV is stored plainly?
EDIT: Thanks for the answers; the general consensus is that I should not use a fixed IV. As .NET has a CSPRNG built in (or at least hooked in from the CryptoServiceProviders) and it's easy enough to make a new one every time I re-encrypt something, I'll just do that, and store it alongside the encrypted data.