I'm designing a program which makes queries to a database stored locally which could potentially contain a lot of sensitive information. As such the information must be kept secure as possible from any possible attack. I plan on doing this by encrypting the data by AES-256 in CBC mode. The encryption / decryption key will be kept secure.
My question is, using this scheme, how should the database be encrypted to ensure the data is kept secure against attacks? Originally I planned on encrypting the database cell by cell (with each row having 10 or so columns) and storing a unique, randomly generated IV for each row.
However, to my understanding of the generated stream this could cause problems as I would be using the same key + IV combination to encrypt / decrypt all the cells of this row. This would allow an attacker to potentially compute the XOR of two cells and reveal enough information where they could decrypt the entire row (two-time pad). I know this is more of a problem in CTR mode but I have read that it could also be a problem in CBC if two of the cells began with the same sequence of bytes. Please correct me if I misunderstand the concept of this type of attack as I am still a little unsure of its exact mechanism.
Encrypting the entire database itself is not very pretty and obviously will cause performance issues if the database is large enough. Therefore, the only other method I could think of is having EACH CELL have a unique, random IV which on the surface seems like a lot of extra data to have to store but I will go this route if need be.
Just as a side note; this program isn't being implemented anywhere in which security will be an issue. It is more of a side project for myself to learn the intricacies of cryptography and ways of defending against attacks. Thank you for all your help in advance!