As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication.
iv.mac1.cipherText(plainText)
The keys are derived using HMAC for simplicity (alternatively could be HKDF)
masterkey = [32 random bytes];
encryptionKey = hmac_sha256(masterkey,'encryption_key');
mac = hmac_sha256(masterkey,'mac_key');
iv = hmac_sha256(masterkey,'iv_key');
Alternatively in a second solution the IV is defined in the codebase:
masterkey = [32 random bytes];
encryptionKey = hmac_sha256(masterkey,'encryption_key');
mac = hmac_sha256(masterkey,'mac_key');
iv = [32 hard coded bytes];
In both scenario's the IV itself is not stored or transmitted, and the masterkey is used to decrypt messages.
Is the static IV really less secure, given that deriving a key for the IV with the same masterkey also produces the same output?