We need to exchange some data encrypted between a device and our software where the device does not have access to a source of randomness. Both the software and the device know the key (although they cannot access it, they can only use it for encryption using AES). We are planning to use AES in CCM or CBC (depending on authentication requirements and capabilities of our crypto library) mode for encryption.
Is it wrong to send a randomly generated value from the software to the device, hash it using SHA-256, and use that for the initialization vector?
Or is it better to send the randomly generated value encrypted as well (we can generate a proper IV on the software side)? I guess it would then matter more whether we use CCM or CBC.
The communication between the device and the software can be intercepted and changed by the attacker.